CVE-2023-35750

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35750
D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Vendor Advisory Patch
https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Vendor Advisory Patch
https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
History

13 May 2025, 13:54

Type Values Removed Values Added
First Time Dlink
Dlink dap-2622 Firmware
Dlink dap-2622
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - Third Party Advisory
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - Vendor Advisory, Patch

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-20078. D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2025-05-13 13:54

NVD link : CVE-2023-35750

Mitre link : CVE-2023-35750

JSON object : View

Products Affected

dlink

  • dap-2622_firmware
  • dap-2622
CWE
NVD-CWE-noinfo