CVE-2023-41186

D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the CGI interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-18804.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-1325_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-1325:-:*:*:*:*:*:*:*

History

12 Mar 2025, 16:27

Type Values Removed Values Added
CPE cpe:2.3:h:dlink:dap-1325:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-1325_firmware:*:*:*:*:*:*:*:*
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 - Mitigation, Vendor Advisory
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ - Third Party Advisory
First Time Dlink
Dlink dap-1325
Dlink dap-1325 Firmware

21 Nov 2024, 08:20

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de divulgación de información de autenticación faltante de D-Link DAP-1325 CGI. Esta vulnerabilidad permite a atacantes adyacentes a la red acceder a diversas funciones en las instalaciones afectadas de los enrutadores D-Link DAP-1325. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe en la implementación de la interfaz CGI. El problema se debe a la falta de autenticación antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para revelar las credenciales almacenadas, lo que provocaría un mayor commit. Era ZDI-CAN-18804.
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351 -
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1323/ -

03 May 2024, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-03 03:15

Updated : 2025-03-12 16:27


NVD link : CVE-2023-41186

Mitre link : CVE-2023-41186

CVE.ORG link : CVE-2023-41186


JSON object : View

Products Affected

dlink

  • dap-1325_firmware
  • dap-1325
CWE
CWE-306

Missing Authentication for Critical Function