CVE-2024-23625

A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-1650_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-1650:-:*:*:*:*:*:*:*

History

31 Jan 2024, 21:06

Type Values Removed Values Added
CPE cpe:2.3:h:dlink:dap-1650:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-1650_firmware:-:*:*:*:*:*:*:*
CWE CWE-77
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References () https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-subscribe-callback-command-injection-vulnerability/ - () https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-subscribe-callback-command-injection-vulnerability/ - Third Party Advisory

26 Jan 2024, 00:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-26 00:15

Updated : 2024-02-05 00:22


NVD link : CVE-2024-23625

Mitre link : CVE-2024-23625

CVE.ORG link : CVE-2024-23625


JSON object : View

Products Affected

dlink

  • dap-1650_firmware
  • dap-1650
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')