CVE-2023-35724: high-severity vulnerability in D-Link DAP-2622
D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.9%
D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the CLI service, which listens on TCP port 23. The server program contains hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-20050.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
D-Link · DAP-2622Related CVEs — D-Link DAP-2622
In the same product, most dangerous first.
CVE-2023-35744HIGHD-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-44416MEDIUMD-Link DAP-2622 Telnet CLI Command Injection Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-35743HIGHD-Link DAP-2622 DDP Configuration Restore Auth Password Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-35725HIGHD-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-37324HIGHD-Link DAP-2622 DDP Set Wireless Info Auth Username Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-37310HIGHD-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%