CVE-2023-35718
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The buffer overflow occurs in the DDP service when processing password change requests. Anyone using affected D-Link DAP-2622 routers is at risk.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with root access, allowing attacker to intercept/modify all network traffic, install persistent malware, or pivot to internal network devices.
Likely Case
Router compromise leading to man-in-the-middle attacks, credential theft, and network disruption.
If Mitigated
Limited impact if router is isolated from critical systems and network segmentation prevents lateral movement.
🎯 Exploit Status
ZDI published detailed advisory with technical details. No public exploit code available but vulnerability is straightforward to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.10B05
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10343
Restart Required: Yes
Instructions:
1. Download firmware 1.10B05 from D-Link support site. 2. Log into router web interface. 3. Navigate to System > Firmware Update. 4. Upload and install the new firmware. 5. Reboot router after installation completes.
🔧 Temporary Workarounds
Block DDP Service Port
linuxBlock access to DDP service port 6050/TCP using firewall rules
iptables -A INPUT -p tcp --dport 6050 -j DROP
Disable DDP Service
linuxDisable the vulnerable DDP service if not required
killall ddpd
chmod -x /usr/sbin/ddpd
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for port 6050 traffic and buffer overflow patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Status > Firmware Version. If version is earlier than 1.10B05, device is vulnerable.Check Version:
ssh admin@router_ip 'cat /etc/version' or check web interfaceVerify Fix Applied:
Verify firmware version shows 1.10B05 or later in System > Status > Firmware Version.📡 Detection & Monitoring
Log Indicators:
- Multiple failed DDP authentication attempts
- Unusual process execution from DDP service
- Buffer overflow patterns in system logs
Network Indicators:
- Unusual traffic to port 6050/TCP
- Large payloads sent to DDP service
- Shellcode patterns in network traffic
SIEM Query:
source_port:6050 AND (payload_size:>1000 OR contains(buffer_overflow_patterns))