CVE-2023-51614 D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability

🗓️ 03 May 2024 02:15:38Reported by zdiType

D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2023-51614	3 May 202403:16	–	attackerkb
BDU FSTEC	D-Link DIR-X3260 prog.cgi Code Execution	18 Jan 202400:00	–	bdu_fstec
CNNVD	D-Link DIR-X3260 安全漏洞	3 May 202400:00	–	cnnvd
CVE	CVE-2023-51614	3 May 202402:15	–	cve
EUVD	EUVD-2023-56326	3 Oct 202520:07	–	euvd
NVD	CVE-2023-51614	3 May 202403:16	–	nvd
osv_cve	CVE-2023-51614	3 May 202403:16	–	osv_cve
Positive Technologies	PT-2023-8307 · D Link · D-Link Dir-X3260	6 Jul 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-51614: Stack-based Buffer Overflow	3 May 202400:00	–	rapid7
Vulnrichment	CVE-2023-51614 D-Link DIR-X3260 prog.cgi SetQuickVPNSettings Password Stack-Based Buffer Overflow Remote Code Execution Vulnerability	3 May 202402:15	–	vulnrichment

[
  {
    "vendor": "D-Link",
    "product": "DIR-X3260",
    "versions": [
      {
        "version": "1.04B01",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-034/

03 May 2024 02:15Current

7.3High risk

Vulners AI Score7.3

CVSS 36.8

EPSS0.01126

SSVC

CWE-121