ZDI-CAN-19910: ZDI-23-052: D-Link DIR-3040 MiniDLNA Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Jan 18, 2023

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability.

Affected Software

1 affected component

D-Link DIR-3040

Event History

Jan 18, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Feb 2, 2025

Advisory Published

via ZDI·01:12 AM

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is ZDI-CAN-19910.

What is the severity of ZDI-CAN-19910?

The severity of ZDI-CAN-19910 is high with a CVSS score of 8.8.

How does the vulnerability in D-Link DIR-3040 routers occur?

The vulnerability in D-Link DIR-3040 routers occurs due to a heap-based buffer overflow in the MiniDLNA service.

Who can exploit this vulnerability?

Network-adjacent attackers can exploit this vulnerability.

Is authentication required to exploit this vulnerability?

No, authentication is not required to exploit this vulnerability.

Where can I find more information about this vulnerability?

You can find more information about this vulnerability at the following links: [Link 1](http://www.zerodayinitiative.com/advisories/ZDI-23-052/), [Link 2](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10322), [Link 3](https://www.zerodayinitiative.com/advisories/ZDI-23-052/).