CVE-2023-35729
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The flaw exists in the DDP service where improper length validation of user-supplied data leads to a stack-based buffer overflow. Only D-Link DAP-2622 router users are affected.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root-level code execution, allowing attackers to intercept traffic, modify configurations, pivot to internal networks, or install persistent malware.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, credential theft, and network reconnaissance from a privileged position.
If Mitigated
Limited impact if router is isolated from sensitive networks, though still vulnerable to local network attacks.
🎯 Exploit Status
ZDI has published technical details but no public exploit code. The vulnerability requires network adjacency but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to System > Firmware Update. 4. Upload and apply the new firmware. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Block DDP Service Port
linuxBlock access to the vulnerable DDP service on port 6050/TCP using firewall rules
iptables -A INPUT -p tcp --dport 6050 -j DROP
Disable DDP Service
linuxDisable the DDP service if not required for functionality
killall ddpd
🧯 If You Can't Patch
- Segment the router on an isolated network VLAN away from critical systems
- Implement strict network access controls to limit which devices can communicate with the router
🔍 How to Verify
Check if Vulnerable:
Check current firmware version via web interface (System > Status) or SSH (cat /etc/version). If version is older than 1.11B01, device is vulnerable.Check Version:
cat /etc/versionVerify Fix Applied:
Confirm firmware version is 1.11B01 or newer. Test that DDP service still functions properly if needed.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 6050
- Multiple failed DDP requests
- Router process crashes or restarts
Network Indicators:
- Unusual traffic patterns to router port 6050/TCP
- Large payloads sent to DDP service
SIEM Query:
source="router.log" AND (port=6050 AND (payload_size>1000 OR error="buffer"))