CVE-2023-41195
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary commands as root on D-Link DAP-1325 routers without authentication. Attackers can inject malicious commands through the IPv6Mode parameter in HNAP1 SOAP requests, leading to complete device compromise. All users of affected D-Link DAP-1325 routers are at risk.
💻 Affected Systems
- D-Link DAP-1325
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover with root privileges, allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and brick the device.
Likely Case
Router compromise leading to network traffic interception, DNS hijacking, credential theft, and installation of backdoors for persistent access.
If Mitigated
Limited impact if device is isolated from untrusted networks, though still vulnerable to insider threats or compromised internal devices.
🎯 Exploit Status
Exploit requires network adjacency but no authentication. Public proof-of-concept code exists, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.11B01
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10351
Restart Required: Yes
Instructions:
1. Download firmware version 1.11B01 from D-Link support site. 2. Log into router web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload the firmware file. 5. Wait for update to complete and router to reboot.
🔧 Temporary Workarounds
Disable HNAP1 Service
allDisable the vulnerable HNAP1 SOAP service if not required
Not available via command line - must use web interface or custom firmware
Network Segmentation
allIsolate DAP-1325 from untrusted networks and limit access to trusted devices only
🧯 If You Can't Patch
- Replace affected DAP-1325 routers with patched or alternative devices
- Implement strict network access controls to limit which devices can communicate with the router's management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Maintenance > Firmware. If version is earlier than 1.11B01, device is vulnerable.Check Version:
curl -s http://router-ip/HNAP1/ | grep -i firmwareVerify Fix Applied:
Verify firmware version shows 1.11B01 or later in Maintenance > Firmware section of web interface.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /HNAP1/ endpoint
- Multiple failed command execution attempts in system logs
- Unexpected process execution from web service
Network Indicators:
- Malformed SOAP requests to port 80 containing shell metacharacters
- Unusual outbound connections from router to external IPs
- Traffic patterns suggesting command-and-control communication
SIEM Query:
source="router-logs" AND (uri_path="/HNAP1/" AND (http_method="POST" AND (content CONTAINS "|" OR content CONTAINS ";" OR content CONTAINS "`")))