PT-2023-3004 · D Link · D-Link Dir-2150

Publicado 2023-04-28 · Atualizado 2025-03-13 · CVE-2023-34274

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-2150 (affected versions not specified)

Description The issue is related to the implementation of the LoginPassword function in the D-Link DIR-2150 router's software, which allows for authentication bypass. This can be exploited by a remote attacker using a specially crafted request. The vulnerability exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted login request can cause authentication to succeed without providing proper credentials, allowing an attacker to bypass authentication on the system.

Recommendations As a temporary workaround, consider disabling the LoginPassword function until a patch is available. Restrict access to the SOAP API interface to minimize the risk of exploitation. Avoid using the default TCP port 80 for the SOAP API interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-303

CWE-592

CWE-287

Identificadores relacionados

BDU:2023-03034

CVE-2023-34274

ZDI-23-627

Produtos afetados

D-Link Dir-2150

Referências · 8

• https://zerodayinitiative.com/advisories/ZDI-23-627 · Nota de Segurança
• https://support.dlink.com.au/Download/download.aspx?product=DIR-2150 · Nota
• https://bdu.fstec.ru/vul/2023-03034 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34274 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34274 · Nota de Segurança
• https://twitter.com/CVEnew/status/1787926501968826854 · Publicação no Twitter
• https://vuldb.com/ru/?id.230641 · Nota
• https://t.me/cvenotify/114773 · Publicação no Telegram