CVE-2024-22916

The sprintf function in the sub_40E700 procedure of the cgibin interface does not perform adequate verification of the size of data written to the stack. An attacker can provide specially crafted input data that exceeds the allocated stack buffer, overwriting adjacent memory areas. Due to the network vector (AV:N) and lack of authentication requirements (PR:N) and user interaction (UI:N), the exploit can be carried out remotely over the network.

Successful exploitation of the vulnerability may allow an attacker to gain full control of the device, including arbitrary code execution (RCE), reading and modifying configuration data, and permanently compromising the router's availability.

Apply patches available from the manufacturer according to the references — detailed information about updates is published in the D-LINK security bulletin at https://www.dlink.com/en/security-bulletin/. Until updates are implemented, it is recommended to restrict access to the device management interface only to trusted IP addresses and disable remote access to the administrative panel.

D-LINK Go-RT-AC750 firmware version v101b03