PT-2023-8306 · D Link · D-Link Dir-X3260

Nicholas Zubrisky + 1 · Published 2023-07-06 · Updated 2024-11-22 · CVE-2023-51615

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:A/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-X3260 (affected versions not specified)

Description The issue is related to a buffer overflow vulnerability in the prog.cgi component of D-Link DIR-X3260 Wi-Fi routers, allowing remote attackers to execute arbitrary code. The vulnerability exists due to the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. This can be exploited by network-adjacent attackers who have authentication credentials. The vulnerability is associated with the SetQuickVPNSettings PSK function and can allow code execution in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2024-00420

CVE-2023-51615

ZDI-24-035

Affected Products

D-Link Dir-X3260

References · 7

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-51615 · Security Note
• https://bdu.fstec.ru/vul/2024-00420 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51615 · Vendor Advisory
• https://twitter.com/CVEnew/status/1786223060410114263 · Twitter Post
• https://vuldb.com/ru/?id.250497 · Note