PT-2023-2017 · D Link · D-Link Dir820La1 Fw106B02

Published 2023-02-06 · Updated 2023-03-16 · CVE-2023-25283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR820LA1 FW106B02

Description A stack overflow issue allows attackers to cause a denial of service via the reserveDHCP HostName 1.1.1.0 parameter to "lan.asp". This is related to a buffer overflow in memory, which can be exploited to cause a denial of service.

Recommendations For D-Link DIR820LA1 FW106B02, as a temporary workaround, consider restricting access to the "lan.asp" endpoint until a patch is available. Avoid using the reserveDHCP HostName 1.1.1.0 parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-01728

CVE-2023-25283

Affected Products

D-Link Dir820La1 Fw106B02

References · 7

• 🔥 https://github.com/migraine-sudo/D_Link_Vuln/tree/main/stackoverflow%20%20in%20reserveDHCP_HostName_1.1.1.0 · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25283 · Security Note
• https://bdu.fstec.ru/vul/2023-01728 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25283 · Vendor Advisory
• https://vuldb.com/?id.222888 · Note
• https://t.me/cibsecurity/59884 · Telegram Post