CVE-2023-45575
📋 TL;DR
A critical stack overflow vulnerability in multiple D-Link router models allows remote attackers to execute arbitrary code via the ip parameter in the ip_position.asp function. This affects D-Link DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200G+V2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 devices running vulnerable firmware versions. Attackers can gain complete control of affected devices without authentication.
💻 Affected Systems
- D-Link DI-7003GV2.D1
- D-Link DI-7100G+V2.D1
- D-Link DI-7100GV2.D1
- D-Link DI-7200G+V2.D1
- D-Link DI-7200GV2.E1
- D-Link DI-7300G+V2.D1
- D-Link DI-7400G+V2.D1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution resulting in device takeover, credential theft, and use as pivot point for internal network attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository. Exploitation requires sending crafted HTTP request to ip_position.asp endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check D-Link security advisories for firmware updates. 2. Download latest firmware for your specific model. 3. Backup configuration. 4. Upload firmware via web interface. 5. Reboot device. 6. Restore configuration if needed.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to device management interface using firewall rules.
Disable Remote Management
allTurn off WAN-side management access if enabled.
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Login > Maintenance > Firmware Upgrade > check current versionCheck Version:
curl -k https://[device-ip]/info.html | grep -i firmwareVerify Fix Applied:
Verify firmware version is newer than affected versions listed above📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /ip_position.asp with long ip parameters
- Unusual process execution in device logs
- Failed authentication attempts followed by successful exploitation
Network Indicators:
- HTTP POST requests to ip_position.asp endpoint
- Unusual outbound connections from router
- Traffic patterns indicating command and control
SIEM Query:
source="router_logs" AND (url="/ip_position.asp" OR url CONTAINS "ip_position") AND (param="ip" AND length(param_value)>100)