PT-2023-5916 · D Link · D-Link Dap-X1860

CVE-2023-45208 · Publicado 2023-05-06 · Atualizado 2024-01-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAP-X1860 versions 1.00 through 1.01b05-01

Description A command injection issue in the parsing xml stasurvey function allows attackers within range of the repeater to run shell commands as root during the setup process via a crafted SSID. Network names containing single quotes can result in a denial of service.

Recommendations For versions 1.00 through 1.01b05-01, update to the latest version that includes the fix provided by D-Link. As a temporary workaround, consider avoiding the use of single quotes in network names and restricting access to the setup process to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2023-06612

CVE-2023-45208

Produtos afetados

D-Link Dap-X1860

Referências · 12

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection · Exploit
• https://bleepingcomputer.com/news/security/d-link-wifi-range-extender-vulnerable-to-command-injection-attacks · Nota
• https://t.me/rnetsec/19429 · Publicação no Telegram
• https://t.me/cibsecurity/71895 · Publicação no Telegram
• https://vuldb.com/?id.241616 · Nota
• https://bdu.fstec.ru/vul/2023-06612 · Nota de Segurança
• https://twitter.com/RedTeamPT/status/1717876693107351926 · Publicação no Twitter
• https://infobezopasnost.ru/blog/news/usilitel-signala-ot-d-link-stavit-pod-ugrozu-vse-ustrojstva-podklyuchennye-k-wi-fi · Nota
• https://t.me/defcon_news/118772 · Publicação no Telegram
• https://twitter.com/RedTeamPT/status/1745465004143624470 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-45208 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45208 · Nota de Segurança