PT-2023-5384 · D Link · D-Link Dwl-6610Ap

Published 2023-07-10 · Updated 2024-09-25 · CVE-2023-43204

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-LINK DWL-6610 version FW v 4.3.0.8B003C

Description The issue is related to a command injection vulnerability in the sub 2EF50() function. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter. The exploitation of this vulnerability can impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-LINK DWL-6610 version FW v 4.3.0.8B003C, as a temporary workaround, consider disabling the sub 2EF50() function until a patch is available. Restrict access to the manual-time-string parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-06012

CVE-2023-43204

Affected Products

D-Link Dwl-6610Ap

References · 8

• 🔥 https://github.com/Archerber/bug_submit/blob/main/D-Link/DWL-6610/bug2.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-43204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06012 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43204 · Security Note
• https://t.me/cvenotify/58425 · Telegram Post
• https://vuldb.com/ru/?id.240037 · Note
• https://twitter.com/VulmonFeeds/status/1704542699318116830 · Twitter Post
• https://twitter.com/CVEnew/status/1704493978010235219 · Twitter Post