PT-2023-2981 · D Link · D-Link Dir-300

Published 2023-04-29 · Updated 2025-01-17 · CVE-2023-31814

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-300 firmware versions <=REVA1.06 and <=REVB2.06

Description The issue is related to incorrect external control of a file name or path in the /model/ lang msg.php script of the D-Link DIR-300 router's firmware. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-Link DIR-300 firmware versions <=REVA1.06, update to a version higher than REVA1.06. For D-Link DIR-300 firmware versions <=REVB2.06, update to a version higher than REVB2.06. As a temporary workaround, consider restricting access to the /model/ lang msg.php script until a patch is available.

Fix

Weakness Enumeration

CWE-73

CWE-706

Related Identifiers

BDU:2023-03001

CVE-2023-31814

Affected Products

D-Link Dir-300

References · 6

• https://osv.dev/vulnerability/CVE-2023-31814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31814 · Security Note
• https://bdu.fstec.ru/vul/2023-03001 · Security Note
• https://dlink.com/en/security-bulletin · Note
• https://vuldb.com/ru/?id.229676 · Note
• https://gist.github.com/1915504804/9503198d3cbd5bc7db47625ac0caaade · Note