PT-2023-3363 · D Link · D-Link Go-Rt-Ac750

CVE-2023-34800 · Publicado 2023-06-15 · Atualizado 2024-12-16

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link Go-RT-AC750 revA v101b03

Description The issue is related to a command injection vulnerability. It can be exploited via the service parameter at genacgi main, allowing a remote attacker to execute arbitrary commands. The vulnerability is associated with the failure to neutralize special elements in the router's firmware.

Recommendations For D-Link Go-RT-AC750 revA v101b03, as a temporary workaround, consider restricting access to the genacgi main endpoint to minimize the risk of exploitation. Avoid using the service parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-03519

CVE-2023-34800

Produtos afetados

D-Link Go-Rt-Ac750

Referências · 6

• 🔥 https://github.com/Tyaoo/IoT-Vuls/blob/main/dlink/Go-RT-AC750/vul.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-34800 · Aviso do Fabricante
• https://t.me/cvenotify/104435 · Publicação no Telegram
• https://dlink.com/en/security-bulletin · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03519 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-34800 · Nota de Segurança