CVE-2023-35750 D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability

🗓️ 03 May 2024 01:58:02Reported by zdiType

D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service due to the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2023-35750	3 May 202402:15	–	attackerkb
BDU FSTEC	D-Link DAP-2622 Information Disclosure	13 Sep 202300:00	–	bdu_fstec
CNNVD	D-Link DAP-2622 安全漏洞	3 May 202400:00	–	cnnvd
CVE	CVE-2023-35750	3 May 202401:58	–	cve
EUVD	EUVD-2023-39749	3 Oct 202520:07	–	euvd
NVD	CVE-2023-35750	3 May 202402:15	–	nvd
osv_cve	CVE-2023-35750	3 May 202402:15	–	osv_cve
Positive Technologies	PT-2023-4966 · D Link · D-Link Dap-2622	25 Aug 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-35750: Exposure of Sensitive Information to an Unauthorized Actor	3 May 202400:00	–	rapid7
Vulnrichment	CVE-2023-35750 D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability	3 May 202401:58	–	vulnrichment

[
  {
    "vendor": "D-Link",
    "product": "DAP-2622",
    "versions": [
      {
        "version": "1.00 dated 16-12-2020",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1255/
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx

18 Sep 2024 18:29Current

7.3High risk

Vulners AI Score7.3

CVSS 37.4

EPSS0.00654

SSVC

CWE-200