PT-2023-6898 · D Link · D-Link Dar-7000

Flyyue2001 · Published 2023-10-26 · Updated 2024-01-02 · CVE-2023-42406

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DAR-7000 version V31R02B1413C

Description The issue is related to a SQL injection vulnerability in the editrole.php component, which can be exploited by a remote attacker to obtain sensitive information and execute arbitrary code. This is due to the lack of protection measures for the SQL query structure.

Recommendations For D-Link DAR-7000 version V31R02B1413C, consider disabling the editrole.php component until a patch is available to prevent exploitation. Restrict access to this component to minimize the risk of arbitrary code execution. Avoid using the vulnerable component for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07916

CVE-2023-42406

Affected Products

D-Link Dar-7000

References · 11

• 🔥 https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md · Exploit
• 🔥 https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-42406 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42406 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-01.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2023-07916 · Security Note
• https://t.me/cibsecurity/73029 · Telegram Post
• https://twitter.com/CVEnew/status/1717660737508700465 · Twitter Post
• https://twitter.com/PentestingN/status/1742073651430662174 · Twitter Post
• https://twitter.com/ksg93rd/status/1742216028963123364 · Twitter Post
• https://t.me/cybersecuritytechnologies/9702 · Telegram Post