PT-2023-6407 · D Link · Dsl-2730U+1

Amey Chavekar + 2 · Published 2023-10-19 · Updated 2024-09-12 · CVE-2023-46033

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U N150 ADSL2+ (affected versions not specified)

Description The issue is related to Incorrect Access Control in the D-Link routers. The UART/Serial interface on the PCB provides log output and a root terminal without proper access control, which can be exploited by an attacker to bypass access restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-07121

CVE-2023-46033

Affected Products

Dsl-2730U

Dsl-2750U

References · 12

• https://bdu.fstec.ru/vul/2023-07121 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46033 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10357 · Note
• https://t.me/cvenotify/88652 · Telegram Post
• https://t.me/cvenotify/94424 · Telegram Post
• https://dlink.com/en/products/dsl-2730u-wireless-n150-adsl2-router · Note
• https://twitter.com/CVEnew/status/1715033409490436332 · Twitter Post
• https://dlink.com/en/products/dsl-2750u-wireless-n-300-adsl2-modem-router · Note
• https://vuldb.com/?id.242952 · Note
• https://twitter.com/Dr_Faruk_Kazi/status/1716826415088402706 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1715072535480426692 · Twitter Post
• https://t.me/cibsecurity/72589 · Telegram Post