D-Link Wi-Fi Range Extender Vulnerability Let Attackers Inject Remote Code

A command injection vulnerability has been discovered in the D-Link DAP-X1860 range extender, allowing threat actors to execute remote code on affected devices. The CVE ID for this vulnerability has been given as CVE-2023-45208, and the severity is being analyzed.

This vulnerability exists in the Wi-Fi network scanning functionality, which threat actors can exploit. D-Link has not yet patched this vulnerability, nor did they respond to any comments regarding this issue. 

FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Free Demo

CVE-2023-45208 – Command Injection Vulnerability in D-Link

A threat actor can create a Wi-Fi network with a crafted SSID within the range of the extender and can execute commands during the setup process. Command injection was also possible when using the network scan function of the range extender.

The extender uses the “GetSiteSurvey” SOAP action to identify nearby networks. If any networks have an apostrophe(‘) on their SSID (for example, `Olaf’s Network`), the setup process crashes repeatedly with a response below.

———————————————————————— Error 500: Internal Server Error CGI program sent malformed HTTP headers: [0   1   *****                **:**:**:**:**:**   WPA2PSK/AES 7        11b/g/n     NONE   In 17       YES      NO 1   1   *****               **:**:**:**:**:** WPA2PSK/AES            24       11b/g/n     NONE   In 13 YES      NO 2   1   *****               **:**:**:**:**:** WPA2PSK/AES            47       11b/g/n/ax  NONE   In 13 YES      NO 3   1   *****               **:**:**:**:**:** WPAPSKWPA2PSK/TKIPAES  81       11b/g/n     NONE   In 7 YES      NO 4   1   *****               **:**:**:**:**:** WPA2PSKWPA3PSK/AES     63       11b/g/n/ax  NONE   In 19 YES      NO 5   1   *****               **:**:**:**:**:** WPA2PSK/AES            44       11b/g/n/ax  NONE   In 5 NO      NO 6   1   Olafs Network **:**:**:**:**:** WPA2PSK/AES 47 11b/g/n/ax NONE In 20 NO NO sh: 7: not found sh ————————————————————————

This can be used for performing a denial-of-service attack on the extender. However, arbitrary command execution can be achieved by including commands on the SSID name, like `uname -a`, which results in the command being executed successfully. 

Error 500: Internal Server Error CGI program sent malformed HTTP headers: [0   1   *****                **:**:**:**:**:**   WPA2PSK/AES 0        11b/g/n     NONE   In 17       YES      NO 1   1   Test Linux dlink-rp 4.4.198 #3 SMP Mon Jan 11 10:38:51 CST 2021 mips GNU/Linux sh: **:**:**:**:**:**: not found sh: 2: not found sh: 3: not found sh: 4: not found […] sh: 40: not

Red team-pen testing has published a complete report about this vulnerability, which provides detailed information about the Proof-of-concept, Security Risk, Timeline, and disclosure of this vulnerability.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.