PT-2023-3004 · D Link · D-Link Dir-2150

Published 2023-04-28 · Updated 2025-03-13 · CVE-2023-34274

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-2150 (affected versions not specified)

Description The issue is related to the implementation of the LoginPassword function in the D-Link DIR-2150 router's software, which allows for authentication bypass. This can be exploited by a remote attacker using a specially crafted request. The vulnerability exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted login request can cause authentication to succeed without providing proper credentials, allowing an attacker to bypass authentication on the system.

Recommendations As a temporary workaround, consider disabling the LoginPassword function until a patch is available. Restrict access to the SOAP API interface to minimize the risk of exploitation. Avoid using the default TCP port 80 for the SOAP API interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-303

CWE-592

CWE-287

Related Identifiers

BDU:2023-03034

CVE-2023-34274

ZDI-23-627

Affected Products

D-Link Dir-2150

References · 8

• https://zerodayinitiative.com/advisories/ZDI-23-627 · Security Note
• https://bdu.fstec.ru/vul/2023-03034 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34274 · Security Note
• https://support.dlink.com.au/Download/download.aspx?product=DIR-2150 · Note
• https://twitter.com/CVEnew/status/1787926501968826854 · Twitter Post
• https://vuldb.com/ru/?id.230641 · Note
• https://t.me/cvenotify/114773 · Telegram Post