PT-2023-5916 · D Link · D-Link Dap-X1860

Published 2023-05-06 · Updated 2024-01-11 · CVE-2023-45208

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAP-X1860 versions 1.00 through 1.01b05-01

Description A command injection issue in the parsing xml stasurvey function allows attackers within range of the repeater to run shell commands as root during the setup process via a crafted SSID. Network names containing single quotes can result in a denial of service.

Recommendations For versions 1.00 through 1.01b05-01, update to the latest version that includes the fix provided by D-Link. As a temporary workaround, consider avoiding the use of single quotes in network names and restricting access to the setup process to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2023-06612

CVE-2023-45208

Affected Products

D-Link Dap-X1860

References · 12

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection · Exploit
• https://bdu.fstec.ru/vul/2023-06612 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45208 · Security Note
• https://bleepingcomputer.com/news/security/d-link-wifi-range-extender-vulnerable-to-command-injection-attacks · Note
• https://t.me/rnetsec/19429 · Telegram Post
• https://t.me/cibsecurity/71895 · Telegram Post
• https://vuldb.com/?id.241616 · Note
• https://twitter.com/RedTeamPT/status/1717876693107351926 · Twitter Post
• https://infobezopasnost.ru/blog/news/usilitel-signala-ot-d-link-stavit-pod-ugrozu-vse-ustrojstva-podklyuchennye-k-wi-fi · Note
• https://t.me/defcon_news/118772 · Telegram Post
• https://twitter.com/RedTeamPT/status/1745465004143624470 · Twitter Post