CVE-2023-35745
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The flaw exists in the DDP service's configuration restore function, where improper length validation enables stack-based buffer overflow. Only users of affected D-Link DAP-2622 routers are impacted.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with root privileges, enabling persistent backdoor installation, network traffic interception, lateral movement to connected devices, and router bricking.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and deployment of malware to connected devices.
If Mitigated
Limited impact with proper network segmentation and access controls preventing adjacent network access to vulnerable routers.
🎯 Exploit Status
ZDI published detailed advisory with technical details. No public exploit code available but vulnerability is straightforward to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and apply the new firmware. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Block DDP Service Access
linuxBlock external and internal access to DDP service port 41234/TCP using firewall rules.
iptables -A INPUT -p tcp --dport 41234 -j DROP
iptables -A FORWARD -p tcp --dport 41234 -j DROP
Disable DDP Service
linuxDisable the vulnerable DDP service if not required for functionality.
killall ddpd
chmod -x /usr/sbin/ddpd
🧯 If You Can't Patch
- Segment vulnerable routers on isolated VLAN with strict access controls.
- Implement network monitoring for port 41234/TCP traffic and block suspicious connections.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (Status > Device Info) or SSH (cat /etc/version). If version is earlier than 1.11B01, device is vulnerable.Check Version:
cat /etc/versionVerify Fix Applied:
Confirm firmware version is 1.11B01 or later. Test DDP service response on port 41234 - patched version should handle malformed requests properly.📡 Detection & Monitoring
Log Indicators:
- Unusual DDP service activity in router logs
- Failed firmware update attempts
- Unexpected process execution
Network Indicators:
- TCP connections to port 41234 with malformed packets
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (port=41234 OR process="ddpd") AND (bytes>1024 OR pattern="overflow")