Details of VAR-202310-2564

ID

VAR-202310-2564

CVE

CVE-2023-45208

TITLE

D-Link Systems, Inc. of DAP-1860 Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-014619

DESCRIPTION

A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service. D-Link Systems, Inc. of DAP-1860 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DAP-X1860 is a wireless router from China D-Link Company. D-Link DAP-X1860 has a code execution vulnerability. The vulnerability arises from the application's failure to properly filter special elements that construct code segments. An attacker could exploit this vulnerability to execute arbitrary commands on the system

Trust: 2.16

sources: NVD: CVE-2023-45208 // JVNDB: JVNDB-2023-014619 // CNVD: CNVD-2024-00661

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-00661

AFFECTED PRODUCTS

vendor:	dlink	model:	dap-1860	scope:	eq	version:	1.00	Trust: 1.0
vendor:	dlink	model:	dap-1860	scope:	eq	version:	1.01b94	Trust: 1.0
vendor:	dlink	model:	dap-1860	scope:	eq	version:	1.01b05-01	Trust: 1.0
vendor:	d link	model:	dap-1860	scope:	eq	version:	dap-1860 firmware 1.01b94	Trust: 0.8
vendor:	d link	model:	dap-1860	scope:	eq	version:	dap-1860 firmware 1.00	Trust: 0.8
vendor:	d link	model:	dap-1860	scope:	eq	version:	-	Trust: 0.8
vendor:	d link	model:	dap-1860	scope:	eq	version:	dap-1860 firmware 1.01b05-01	Trust: 0.8
vendor:	d link	model:	dap-1860	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dap-x1860 >=1.00,<=1.01b05-01	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2024-00661 // JVNDB: JVNDB-2023-014619 // NVD: CVE-2023-45208

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-45208
value:	HIGH
Trust: 1.0
NVD:	CVE-2023-45208
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2024-00661
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-00661
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2023-45208
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2023-45208
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-00661 // JVNDB: JVNDB-2023-014619 // NVD: CVE-2023-45208

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	Command injection (CWE-77) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-014619 // NVD: CVE-2023-45208

EXTERNAL IDS

db:	NVD	id:	CVE-2023-45208	Trust: 3.2
db:	JVNDB	id:	JVNDB-2023-014619	Trust: 0.8
db:	CNVD	id:	CNVD-2024-00661	Trust: 0.6

sources: CNVD: CNVD-2024-00661 // JVNDB: JVNDB-2023-014619 // NVD: CVE-2023-45208

REFERENCES

url:	https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-45208	Trust: 1.4

sources: CNVD: CNVD-2024-00661 // JVNDB: JVNDB-2023-014619 // NVD: CVE-2023-45208

SOURCES

db:	CNVD	id:	CNVD-2024-00661
db:	JVNDB	id:	JVNDB-2023-014619
db:	NVD	id:	CVE-2023-45208

LAST UPDATE DATE

2024-08-14T14:09:45.552000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-00661	date:	2024-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2023-014619	date:	2023-12-25T03:26:00
db:	NVD	id:	CVE-2023-45208	date:	2023-10-16T18:48:47.807

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-00661	date:	2024-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2023-014619	date:	2023-12-25T00:00:00
db:	NVD	id:	CVE-2023-45208	date:	2023-10-10T05:15:09.260