CVE-2023-35757

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35757
D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20085.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1262/ Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1262/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
History

19 May 2025, 16:33

Type Values Removed Values Added
CPE cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
First Time Dlink
Dlink dap-2622 Firmware
Dlink dap-2622
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1262/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1262/ - Third Party Advisory
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - Patch, Vendor Advisory
CWE CWE-787

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20085. D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20085.

07 May 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-07 23:15

Updated : 2025-05-19 16:33

NVD link : CVE-2023-35757

Mitre link : CVE-2023-35757

JSON object : View

Products Affected

dlink

  • dap-2622_firmware
  • dap-2622
CWE
CWE-787

Out-of-bounds Write