PT-2023-5382 · D Link · D-Link Dwl-6610Ap

Published 2023-07-10 · Updated 2024-09-25 · CVE-2023-43202

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-LINK DWL-6610AP version FW v 4.3.0.8B003C

Description A command injection issue was found in the pcap download handler function, allowing attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter. This could potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-LINK DWL-6610AP version FW v 4.3.0.8B003C, as a temporary workaround, consider disabling the pcap download handler function until a patch is available. Restrict access to the update.device.packet-capture.tftp-file-name parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-06010

CVE-2023-43202

Affected Products

D-Link Dwl-6610Ap

References · 7

• 🔥 https://github.com/Archerber/bug_submit/blob/main/D-Link/DWL-6610/bug4.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-43202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43202 · Security Note
• https://vuldb.com/?id.240043 · Note
• https://twitter.com/VulmonFeeds/status/1704544218897613206 · Twitter Post
• https://twitter.com/CVEnew/status/1704493975707529695 · Twitter Post