CVE-2022-43622

Vulnerability

A stack-based buffer overflow exists in the handling of Login requests to the web management portal of D-Link DIR-1935 routers running firmware version 1.03 (including DIR1935A1_FW1.03B02_Beta_ipv6_default_gateway_20181224.bin [1]). The vulnerability occurs when parsing the HNAP_AUTH header; the process does not properly validate the length of user-supplied data before copying it to a fixed-length stack-based buffer [2]. No authentication is required to reach this code path.

Exploitation

An attacker on the same network (network-adjacent) can send a specially crafted Login request with an oversized HNAP_AUTH header to the router's web management portal. The lack of proper length validation leads to a stack-based buffer overflow, allowing the attacker to overwrite the stack and control execution flow [2].

Impact

Successful exploitation grants arbitrary code execution in the context of the root user, giving the attacker full control over the affected router [2]. This can lead to complete compromise of confidentiality, integrity, and availability of the device and the network it serves.

Mitigation

D-Link has acknowledged the vulnerability and stated that security patches are being developed [1]. As of the publication date of this CVE (2023-03-29), no fixed firmware version has been released in the available references. Users should monitor D-Link's support page for updates and consider restricting access to the web management portal to trusted networks only.