CVE-2023-45208: Command Injection
A command injection in the parsingxmlstasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45208?
The severity of CVE-2023-45208 is high.
How does the command injection vulnerability in CVE-2023-45208 work?
The command injection vulnerability in CVE-2023-45208 allows attackers within range of the repeater to run shell commands as root during the setup process of the repeater by sending a crafted SSID.
Which software versions are affected by CVE-2023-45208?
The D-Link DAP-X1860 repeater firmware versions 1.00 and 1.01b05-01 are affected by CVE-2023-45208.
How can I fix CVE-2023-45208?
To fix CVE-2023-45208, update the firmware of your D-Link DAP-X1860 repeater to a version that is not vulnerable.
Where can I find more information about CVE-2023-45208?
You can find more information about CVE-2023-45208 at the following reference: https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-006/-d-link-dap-x1860-remote-command-injection