CVE-2023-41191
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary commands as root on D-Link DAP-1325 routers without authentication. The flaw exists in the HNAP1 SOAP endpoint's handling of the Mode parameter in SetAPLanSettings requests, enabling command injection. Only D-Link DAP-1325 router users are affected.
💻 Affected Systems
- D-Link DAP-1325
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, install persistent malware, pivot to other devices, and permanently brick the device.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, credential theft, and network disruption.
If Mitigated
Limited impact with proper network segmentation and access controls preventing adjacent network access.
🎯 Exploit Status
Exploit requires crafting a specific SOAP request to the HNAP1 endpoint. No authentication needed. Public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
Restart Required: Yes
Instructions:
1. Download firmware 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and install the new firmware. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable HNAP1 Service
allDisable the vulnerable HNAP1 SOAP endpoint if not needed
Not available via command line - must use web interface: System > Management > HNAP Settings > Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected DAP-1325 routers with patched or different models
- Implement strict network access controls to limit adjacent device access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Status > Device Info. If version is earlier than 1.11B01, device is vulnerable.Check Version:
curl -s http://router-ip/HNAP1/ | grep -i "device description" (indirect method)Verify Fix Applied:
Verify firmware version shows 1.11B01 or later in web interface Status > Device Info.📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests to /HNAP1/ endpoint
- Multiple failed authentication attempts followed by successful SetAPLanSettings request
- System command execution logs from unexpected processes
Network Indicators:
- SOAP requests to router IP port 80 with Mode parameter containing shell metacharacters
- Unusual outbound connections from router to external IPs
SIEM Query:
source="router-logs" AND (uri="/HNAP1/" AND (method="POST" AND body CONTAINS "SetAPLanSettings" AND body CONTAINS ["&", ";", "|", "`"]))