CVE-2023-51614 D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability

🗓️ 03 May 2024 02:15:38Reported by zdiType

D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2023-51614	3 May 202403:16	–	attackerkb
BDU FSTEC	The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers allows a hacker to execute arbitrary code.	18 Jan 202400:00	–	bdu_fstec
CNNVD	D-Link DIR-X3260 安全漏洞	3 May 202400:00	–	cnnvd
CVE	CVE-2023-51614	3 May 202402:15	–	cve
EUVD	EUVD-2023-56326	3 Oct 202520:07	–	euvd
NVD	CVE-2023-51614	3 May 202403:16	–	nvd
OSV	CVE-2023-51614	3 May 202403:16	–	osv
Positive Technologies	PT-2023-8307 · D Link · D-Link Dir-X3260	6 Jul 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-51614 D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability	3 May 202402:15	–	vulnrichment
Zero Day Initiative	D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability	11 Jan 202400:00	–	zdi

[
  {
    "vendor": "D-Link",
    "product": "DIR-X3260",
    "versions": [
      {
        "version": "1.04B01",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-034/

03 May 2024 02:15Current

7.3High risk

Vulners AI Score7.3

CVSS 36.8

EPSS0.01126

CWE-121