D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the CGI interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-18804.
References
Link | Resource |
---|---|
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 | Mitigation Vendor Advisory |
https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ | Third Party Advisory |
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 | Mitigation Vendor Advisory |
https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
12 Mar 2025, 16:27
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:dlink:dap-1325:-:*:*:*:*:*:*:* cpe:2.3:o:dlink:dap-1325_firmware:*:*:*:*:*:*:*:* |
|
References | () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 - Mitigation, Vendor Advisory | |
References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ - Third Party Advisory | |
First Time |
Dlink
Dlink dap-1325 Dlink dap-1325 Firmware |
21 Nov 2024, 08:20
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
References | () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 - | |
References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ - |
03 May 2024, 03:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-05-03 03:15
Updated : 2025-03-12 16:27
NVD link : CVE-2023-41186
Mitre link : CVE-2023-41186
CVE.ORG link : CVE-2023-41186
JSON object : View
Products Affected
dlink
- dap-1325_firmware
- dap-1325
CWE
CWE-306
Missing Authentication for Critical Function