CVE-2023-39669

Vulnerability

A NULL pointer dereference vulnerability exists in the D-Link DIR-880 A1 running firmware version FW107WWb08. The bug resides in the function FUN_00010824, which is reachable through network input. No authentication or special configuration is required for an attacker to trigger this code path. [1]

Exploitation

An unauthenticated attacker on the local network can exploit this vulnerability by sending a specially crafted packet to the device. The packet must be designed to cause the affected function to dereference a NULL pointer, leading to a system crash. No user interaction is needed. [2]

Impact

Successful exploitation results in a denial of service (DoS) condition, causing the router to crash and become unresponsive until it is manually rebooted. The compromise is limited to availability; confidentiality and integrity are not directly affected. [1]

Mitigation

D-Link has not released a firmware update for this vulnerability as of the publication date. The DIR-880 A1 model may be end-of-life; users should check the D-Link support website [1] for legacy product status. If the device is unsupported, the only mitigation is to replace the router or restrict network access to trusted devices only.