CVE-2023-35750: D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability
D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35750?
CVE-2023-35750 is considered to have a high severity due to its potential to disclose sensitive information without authentication.
How do I fix CVE-2023-35750?
To fix CVE-2023-35750, update the D-Link DAP-2622 firmware to the latest version provided by the vendor.
Which devices are affected by CVE-2023-35750?
CVE-2023-35750 specifically affects the D-Link DAP-2622 router.
Can CVE-2023-35750 be exploited remotely?
CVE-2023-35750 can be exploited by network-adjacent attackers, meaning physical proximity to the device is required.
Does CVE-2023-35750 require authentication to exploit?
No, CVE-2023-35750 does not require authentication, making it easier for attackers to exploit.