CVE-2023-45208

High8.8Published on October 10, 2023

A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.

CVSS score8.8 / 10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-77

Vendorsdlink

Affected products

Vendors	Product	Versions
dlink	dap-1860 firmware	1.00
dlink	dap-1860	-

Data Breaches

Army Soldier Gets 70 Months for Turning Telecom Metadata Into Extortion Leverage

U.S. Army soldier Cameron Wagenius got 70 months for stealing AT&T Snowflake data on 100M+ customers and extorting victims for Bitcoin.

Sep 26, 202607:416 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Army Soldier Gets 70 Months for Turning Telecom Metadata Into Extortion Leverage