CVE-2023-6580: D-Link DIR-846 QoS POST deserialization

Published Dec 7, 2023

Updated

A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqosexpressdevices/smartqosnormaldevices leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

All of the following

Dlink Dir-846 Firmware=100a53dbr

Dlink Dir-846

Event History

Dec 7, 2023

CVE Published

09:31 PM

Data Sourced

09:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-6580?

CVE-2023-6580 is classified as a critical vulnerability.

How do I fix CVE-2023-6580?

To fix CVE-2023-6580, update the D-Link DIR-846 firmware to the latest version provided by D-Link.

What component is affected by CVE-2023-6580?

CVE-2023-6580 affects the QoS POST Handler in the /HNAP1/ component of the D-Link DIR-846.

What type of vulnerability is CVE-2023-6580?

CVE-2023-6580 is a deserialization vulnerability caused by improper handling of certain input parameters.

Which devices are affected by CVE-2023-6580?

CVE-2023-6580 specifically affects the D-Link DIR-846 with firmware version 100A53DBR.