CVE-2023-41187: D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability
D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the HNAP interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18807.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41187?
CVE-2023-41187 is a critical severity vulnerability that allows remote code execution without authentication.
How do I fix CVE-2023-41187?
To remediate CVE-2023-41187, update your D-Link DAP-1325 to the latest firmware version provided by D-Link.
Who is affected by CVE-2023-41187?
Only users with D-Link DAP-1325 routers are affected by CVE-2023-41187.
Can CVE-2023-41187 be exploited remotely?
Yes, CVE-2023-41187 can be exploited by network-adjacent attackers due to the missing authentication.
What kind of attacks can CVE-2023-41187 enable?
CVE-2023-41187 can enable arbitrary code execution on affected installations, leading to potential full system compromise.