PT-2023-5383 · D Link · D-Link Dwl-6610Ap

Published 2023-07-10 · Updated 2024-09-25 · CVE-2023-43206

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-LINK DWL-6610AP version 4.3.0.8B003C

Description A command injection issue was discovered in the web cert download handler function, allowing attackers to execute arbitrary commands via the certDownload parameter. This could potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-LINK DWL-6610AP version 4.3.0.8B003C, as a temporary workaround, consider disabling the web cert download handler function until a patch is available. Restrict access to the certDownload parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-06011

CVE-2023-43206

Affected Products

D-Link Dwl-6610Ap

References · 8

• 🔥 https://github.com/Archerber/bug_submit/blob/main/D-Link/DWL-6610/bug6.md · Exploit
• https://bdu.fstec.ru/vul/2023-06011 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43206 · Security Note
• https://twitter.com/VulmonFeeds/status/1704541685919670660 · Twitter Post
• https://vuldb.com/?id.240044 · Note
• https://twitter.com/CVEnew/status/1704493981998924181 · Twitter Post
• https://t.me/cvenotify/58424 · Telegram Post