PT-2024-5966 · D Link+1 · D-Link Dap-2310+1

Hahna Latonick · Published 2024-07-09 · Updated 2024-09-03 · CVE-2024-45623

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAP-2310 Hardware A Firmware 1.16RC028

Description The issue is related to a stack-based buffer overflow in the ATP binary that handles PHP HTTP GET requests for the Apache HTTP Server. This allows remote attackers to execute arbitrary code. The vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For D-Link DAP-2310 Hardware A Firmware 1.16RC028, consider isolating vulnerable devices on separate VLANs and plan to decommission them as soon as possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-06773

CVE-2024-45623

Affected Products

Apache Http Server

D-Link Dap-2310

References · 10

• https://bdu.fstec.ru/vul/2024-06773 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45623 · Security Note
• https://t.me/cvedetector/4661 · Telegram Post
• https://twitter.com/CVEnew/status/1830710164330017131 · Twitter Post
• https://t.me/cvenotify/93018 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1830741798303551745 · Twitter Post
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10406 · Note
• https://twitter.com/RsSI47041968/status/1831033304230793432 · Twitter Post
• https://vuldb.com/?id.276356 · Note
• https://twitter.com/oktsec/status/1830730999522611505 · Twitter Post