CVE-2023-35725
📋 TL;DR
This is a critical stack-based buffer overflow vulnerability in D-Link DAP-2622 routers that allows network-adjacent attackers to execute arbitrary code as root without authentication. The vulnerability exists in the DDP service due to insufficient input validation. All users of affected D-Link DAP-2622 routers are at risk.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root-level remote code execution, allowing attackers to intercept traffic, modify configurations, pivot to internal networks, or install persistent malware.
Likely Case
Router takeover leading to man-in-the-middle attacks, DNS hijacking, credential theft, and network disruption.
If Mitigated
Limited impact if router is isolated from untrusted networks and has strict network segmentation.
🎯 Exploit Status
The vulnerability requires network adjacency but no authentication, making exploitation straightforward for attackers on the same network segment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware version 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and apply the new firmware. 5. Wait for router to reboot automatically.
🔧 Temporary Workarounds
Block DDP Service Port
linuxBlock access to the vulnerable DDP service port using firewall rules
iptables -A INPUT -p tcp --dport 41234 -j DROP
iptables -A INPUT -p udp --dport 41234 -j DROP
Disable DDP Service
linuxDisable the DDP service if not required for functionality
killall ddpd
chmod -x /usr/sbin/ddpd
🧯 If You Can't Patch
- Segment the router on an isolated VLAN away from untrusted devices
- Implement strict network access controls to limit which devices can communicate with the router
🔍 How to Verify
Check if Vulnerable:
Check current firmware version via web interface (Status > Device Info) or SSH (cat /etc/version). If version is earlier than 1.11B01, the device is vulnerable.Check Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is 1.11B01 or later. Test that DDP service still functions if required for legitimate use cases.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 41234
- Multiple failed DDP authentication attempts
- Unexpected process execution on router
Network Indicators:
- Unusual traffic patterns to/from router port 41234
- Suspicious payloads in DDP protocol traffic
SIEM Query:
source="router_logs" dest_port=41234 AND (payload_size>normal OR suspicious_patterns)