PT-2023-5871 · D Link · D-Link Dsl-3782

CVE-2023-44959 · Publicado 2023-02-10 · Atualizado 2024-09-18

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 versions 1.03 and earlier

Description The issue allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the network settings page. This is related to the lack of protection measures for the web page structure when handling the Router IP Address fields. Exploitation of the issue can allow a remote attacker to execute arbitrary code.

Recommendations For D-Link DSL-3782 versions 1.03 and earlier, consider disabling access to the network settings page until a patch is available. Restrict access to the Router IP Address fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

XSS

Enumeração de Fraquezas

CWE-77

CWE-79

Identificadores relacionados

BDU:2023-06564

CVE-2023-44959

Produtos afetados

D-Link Dsl-3782

Referências · 8

• 🔥 https://github.com/FzBacon/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection/blob/master/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection.md#cve-2023-27216_d-link_dsl-3782_router_command_injection · Exploit
• https://bdu.fstec.ru/vul/2023-06564 · Nota de Segurança
• https://t.me/cvenotify/95153 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-44959 · Nota de Segurança
• https://t.me/cvenotify/59167 · Publicação no Telegram
• https://vuldb.com/?id.241628 · Nota
• https://osv.dev/vulnerability/CVE-2023-44959 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/18 · Publicação no Telegram