HIGH🇵🇱 Wersja polska

CVE-2023-32136

CVSS 8.8v3.1pub. 2024-05-03upd. 2025-05-16

D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:menu parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18414.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dap 1360

    HW
    Dlink
    f1

  • Dlink Dap 1360 Firmware

    OS
    Dlink
    < 6.15eub01

  • Dlink Dap 2020

    HW
    Dlink
    a2

  • Dlink Dap 2020 Firmware

    OS
    Dlink
    < 1.03rc004
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEMemory
CWE
References

Related vulnerabilities

CVE-2021-44127CRITICAL9.8ten sam produkt

In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter...

CVE-2023-32140HIGH7.5ten sam produkt

D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vul...

CVE-2023-32139HIGH8.8ten sam produkt

D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability al...

CVE-2023-32138HIGH8.8ten sam produkt

D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability all...

CVE-2023-32141HIGH8.8ten sam produkt

D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability. This ...