CVE-2023-35755
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on D-Link DAP-2622 routers without authentication. The flaw exists in the DDP service where improper length validation of user-supplied data leads to a stack-based buffer overflow. Only D-Link DAP-2622 router users are affected.
💻 Affected Systems
- D-Link DAP-2622
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root-level remote code execution, allowing attackers to intercept traffic, modify configurations, pivot to internal networks, or install persistent malware.
Likely Case
Router takeover leading to network traffic interception, DNS hijacking, credential theft, and potential lateral movement to connected devices.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing adjacent network access to the vulnerable service.
🎯 Exploit Status
No authentication required, network-adjacent access needed. ZDI has published technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349
Restart Required: Yes
Instructions:
1. Download firmware version 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and install the new firmware. 5. Reboot the router.
🔧 Temporary Workarounds
Block DDP Service Access
linuxUse firewall rules to block access to the vulnerable DDP service on port 41234/TCP from untrusted networks.
iptables -A INPUT -p tcp --dport 41234 -j DROP
Disable DDP Service
allIf DDP service is not required, disable it through router configuration.
🧯 If You Can't Patch
- Segment the router on an isolated network VLAN with strict access controls
- Implement network monitoring for unusual traffic to/from port 41234/TCP
🔍 How to Verify
Check if Vulnerable:
Check current firmware version in router web interface under Status > Device Info. If version is earlier than 1.11B01, the device is vulnerable.Check Version:
Check router web interface or use: telnet [router_ip] 41234 and examine response (not recommended on production systems)Verify Fix Applied:
Confirm firmware version shows 1.11B01 or later in router web interface. Test that DDP service still functions if needed for legitimate use.📡 Detection & Monitoring
Log Indicators:
- Unusual connection attempts to port 41234
- Multiple failed DDP service requests
- Router configuration changes without authorized activity
Network Indicators:
- Unusual traffic patterns to/from router port 41234/TCP
- Suspicious payloads in DDP protocol communications
- Network scanning activity targeting port 41234
SIEM Query:
source_ip="router_ip" AND dest_port=41234 AND protocol=TCP AND (bytes_sent>1000 OR bytes_received>1000)