ID
VAR-202310-0084
CVE
CVE-2023-44403
TITLE
D-Link Systems, Inc. of DAP-1325 in the firmware OS Command injection vulnerability
Trust: 0.8
DESCRIPTION
D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18822. D-Link Systems, Inc. of DAP-1325 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DAP-1325 is a wireless access point/bridge manufactured by D-Link. It is primarily used to extend wireless network coverage, support conversion between wired and wireless networks, and connect different wireless networks
Trust: 2.79
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | d link | model: | dap-1325 | scope: | - | version: | - | Trust: 2.1 |
| vendor: | dlink | model: | dap-1325 | scope: | lt | version: | 1.09b03 | Trust: 1.0 |
| vendor: | d link | model: | dap-1325 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | d link | model: | dap-1325 | scope: | eq | version: | dap-1325 firmware 1.09b03 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-78 | Trust: 1.0 |
| problemtype: | OS Command injection (CWE-78) [ others ] | Trust: 0.8 |
| problemtype: | OS Command injection (CWE-78) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | Patch for D-Link DAP-1325 Command Injection Remote Code Execution Vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/735081 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-44403 | Trust: 3.9 |
| db: | ZDI | id: | ZDI-23-1501 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2023-028371 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-18822 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2025-22624 | Trust: 0.6 |
REFERENCES
| url: | https://www.zerodayinitiative.com/advisories/zdi-23-1501/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-44403 | Trust: 0.8 |
| url: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2023-44403 | Trust: 0.6 |
CREDITS
Dmitry "InfoSecDJ" Janushkevich of Trend Micro Zero Day Initiative
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-23-1501 |
| db: | CNVD | id: | CNVD-2025-22624 |
| db: | JVNDB | id: | JVNDB-2023-028371 |
| db: | NVD | id: | CVE-2023-44403 |
LAST UPDATE DATE
2025-09-28T03:15:28.979000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-23-1501 | date: | 2023-10-04T00:00:00 |
| db: | CNVD | id: | CNVD-2025-22624 | date: | 2025-09-26T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-028371 | date: | 2025-03-13T06:01:00 |
| db: | NVD | id: | CVE-2023-44403 | date: | 2025-03-12T17:40:48.943 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-23-1501 | date: | 2023-10-04T00:00:00 |
| db: | CNVD | id: | CNVD-2025-22624 | date: | 2025-09-24T00:00:00 |
| db: | JVNDB | id: | JVNDB-2023-028371 | date: | 2025-03-13T00:00:00 |
| db: | NVD | id: | CVE-2023-44403 | date: | 2024-05-03T03:15:53.097 |