PT-2023-2981 · D Link · D-Link Dir-300

CVE-2023-31814 · Publicado 2023-04-29 · Atualizado 2025-01-17

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-300 firmware versions <=REVA1.06 and <=REVB2.06

Description The issue is related to incorrect external control of a file name or path in the /model/ lang msg.php script of the D-Link DIR-300 router's firmware. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-Link DIR-300 firmware versions <=REVA1.06, update to a version higher than REVA1.06. For D-Link DIR-300 firmware versions <=REVB2.06, update to a version higher than REVB2.06. As a temporary workaround, consider restricting access to the /model/ lang msg.php script until a patch is available.

Correção

Enumeração de Fraquezas

CWE-73

CWE-706

Identificadores relacionados

BDU:2023-03001

CVE-2023-31814

Produtos afetados

D-Link Dir-300

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-31814 · Aviso do Fabricante
• https://dlink.com/en/security-bulletin · Nota
• https://vuldb.com/ru/?id.229676 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31814 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03001 · Nota de Segurança
• https://gist.github.com/1915504804/9503198d3cbd5bc7db47625ac0caaade · Nota