CVE-2023-35739
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The flaw exists in the DDP service's handling of IPv6 addresses, where improper length validation leads to a stack-based buffer overflow. Only users of affected D-Link DAP-2622 routers are impacted.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with root privileges, allowing attacker to intercept/modify all network traffic, install persistent malware, pivot to internal network devices, and disable security functions.
Likely Case
Router compromise leading to man-in-the-middle attacks, credential theft, network reconnaissance, and potential lateral movement to connected devices.
If Mitigated
Limited impact due to network segmentation, with attacker confined to isolated network segment and unable to reach critical systems.
🎯 Exploit Status
No authentication required, network-adjacent access needed. ZDI has technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.10B05
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware 1.10B05 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and install the new firmware. 5. Reboot router after installation completes.
🔧 Temporary Workarounds
Disable DDP Service
allDisable the vulnerable DDP service if not required for functionality
Check router web interface for DDP/Discovery service settings
Network Segmentation
allIsolate DAP-2622 devices on separate VLAN to limit attack surface
Configure switch ACLs to restrict access to port 60502/TCP
🧯 If You Can't Patch
- Segment affected routers on isolated network VLAN with strict firewall rules
- Implement network monitoring for traffic to/from port 60502/TCP and block suspicious connections
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Status > Device Info. If version is earlier than 1.10B05, device is vulnerable.Check Version:
Check via web interface or SSH if enabled: cat /etc/version or show version in CLIVerify Fix Applied:
Confirm firmware version shows 1.10B05 or later in router web interface. Test DDP service functionality if required.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 60502/TCP
- Multiple failed DDP requests
- Router reboot/crash logs
Network Indicators:
- Traffic to port 60502/TCP with malformed IPv6 addresses
- Unusual outbound connections from router
SIEM Query:
source_ip="router_ip" AND dest_port=60502 AND protocol=TCP