PT-2023-5381 · D Link · D-Link Dwl-6610Ap

Published 2023-07-10 · Updated 2024-09-25 · CVE-2023-43207

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-LINK DWL-6610 version 4.3.0.8B003C

Description The issue is related to a command injection vulnerability in the config upload handler function. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter. The vulnerability is associated with the failure to neutralize special elements used in the operating system command when processing the configRestore parameter. Exploitation of the vulnerability can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For version 4.3.0.8B003C, consider disabling the config upload handler function until a patch is available to prevent exploitation of the command injection vulnerability via the configRestore parameter. Restrict access to the configRestore parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-06009

CVE-2023-43207

Affected Products

D-Link Dwl-6610Ap

References · 8

• 🔥 https://github.com/Archerber/bug_submit/blob/main/D-Link/DWL-6610/bug3.md · Exploit
• https://bdu.fstec.ru/vul/2023-06009 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43207 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43207 · Vendor Advisory
• https://t.me/cvenotify/58423 · Telegram Post
• https://vuldb.com/?id.240045 · Note
• https://twitter.com/VulmonFeeds/status/1704543712339018027 · Twitter Post
• https://twitter.com/CVEnew/status/1704493983454441707 · Twitter Post