CVE-2023-35747
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The flaw exists in the DDP service's firmware upgrade authentication password handling, where improper length validation leads to a stack-based buffer overflow. Only D-Link DAP-2622 routers with vulnerable firmware are affected.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root privileges, allowing attackers to intercept/modify network traffic, pivot to internal networks, install persistent backdoors, or brick the device.
Likely Case
Router compromise leading to man-in-the-middle attacks, credential theft, network reconnaissance, and potential lateral movement to connected devices.
If Mitigated
Limited to denial of service if exploit attempts are detected and blocked, but router remains vulnerable to subsequent attacks.
🎯 Exploit Status
ZDI published technical details and proof-of-concept. Exploitation requires network adjacency but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to System > Firmware Upgrade. 4. Upload and install the new firmware. 5. Reboot router after installation completes.
🔧 Temporary Workarounds
Block DDP Service Port
linuxBlock access to the vulnerable DDP service port on the router's firewall
iptables -A INPUT -p tcp --dport 39717 -j DROP
Disable DDP Service
linuxDisable the DDP service if not required for functionality
killall -9 ddpd
chmod -x /usr/sbin/ddpd
🧯 If You Can't Patch
- Segment network to isolate DAP-2622 routers from untrusted networks
- Implement strict network access controls to limit who can reach port 39717/TCP
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > Status) or SSH: cat /etc/versionCheck Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is 1.11B01 or later. Test DDP service response on port 39717.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 39717
- DDP service crashes or restarts
- Large payloads sent to DDP service
Network Indicators:
- Exploit-sized packets to port 39717/TCP
- Shellcode patterns in network traffic
- Unexpected outbound connections from router
SIEM Query:
source_port:39717 AND (payload_size>1000 OR contains(payload, '\x90\x90\x90'))