HIGH🇵🇱 Wersja polska

CVE-2023-32143

CVSS 8.8v3.1pub. 2024-05-03upd. 2025-05-16

D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webupg endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18423.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dap 1360

    HW
    Dlink
    f1

  • Dlink Dap 1360 Firmware

    OS
    Dlink
    < 6.15eub01

  • Dlink Dap 2020

    HW
    Dlink
    a2

  • Dlink Dap 2020 Firmware

    OS
    Dlink
    < 1.03rc004
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2021-44127CRITICAL9.8ten sam produkt

In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter...

CVE-2023-32139HIGH8.8ten sam produkt

D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability al...

CVE-2023-32138HIGH8.8ten sam produkt

D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability all...

CVE-2023-32136HIGH8.8ten sam produkt

D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnera...

CVE-2023-32140HIGH7.5ten sam produkt

D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vul...