CVE-2023-51123

An attacker sends a crafted HTTP POST request to the device's CGI component, passing a malicious value in the 'service' parameter handled by the soapcgi_main function in the cgibin binary component. Lack of proper input validation (CWE-78 — command injection) causes the passed value to be interpreted as a system command and executed in the device's context. The attack is possible remotely, without authentication and without user interaction, making it particularly dangerous.

An attacker can execute arbitrary code on the vulnerable device, gaining full control over the router, including the ability to modify configuration, intercept network traffic, and use the device as an entry point for further attacks on the internal network.

Apply patches available from the manufacturer according to references. If an update is not available, it is recommended to restrict access to the device management interface through a firewall or isolate the device from untrusted networks, and consider replacing the device with a model actively supported by the manufacturer.

D-Link DIR-815 with firmware version 1.01SSb08.bin