A command injection vulnerability exists in D-Link DAP... · CVE-2024-23625 · GitHub Advisory Database · GitHub

A command injection vulnerability exists in D-Link DAP...

Critical severity Unreviewed Published Jan 26, 2024 to the GitHub Advisory Database • Updated Jan 26, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.

References

Published by the National Vulnerability Database

Jan 26, 2024

Published to the GitHub Advisory Database Jan 26, 2024

Last updated Jan 26, 2024

Severity

Critical

9.7

/ 10

CVSS base metrics

Attack vector

Adjacent

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H