CVE-2023-34278 D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability

🗓️ 03 May 2024 01:57:07Reported by zdiType

D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2023-34278	3 May 202402:15	–	attackerkb
BDU FSTEC	The vulnerability of the SetSysEmailSettings function in the application software interface of D-Link DIR-2150 router software allows a hacker to execute arbitrary code.	7 Jun 202300:00	–	bdu_fstec
CNNVD	D-Link DIR-2150 安全漏洞	3 May 202400:00	–	cnnvd
CNVD	Remote Code Execution Vulnerability in D-Link DIR-2150 (CNVD-2024-33402)	12 Jul 202400:00	–	cnvd
CVE	CVE-2023-34278	3 May 202401:57	–	cve
EUVD	EUVD-2023-38359	3 Oct 202520:07	–	euvd
NVD	CVE-2023-34278	3 May 202402:15	–	nvd
OSV	CVE-2023-34278	3 May 202402:15	–	osv
Vulnrichment	CVE-2023-34278 D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability	3 May 202401:57	–	vulnrichment
Zero Day Initiative	D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability	15 May 202300:00	–	zdi

[
  {
    "vendor": "D-Link",
    "product": "DIR-2150",
    "versions": [
      {
        "version": "1.05B01",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-626/

03 May 2024 01:57Current

7.5High risk

Vulners AI Score7.5

CVSS 36.8

EPSS0.00184

CWE-78