CVE-2023-44959

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the network settings page.

Un problema encontrado en D-Link DSL-3782 v.1.03 y anteriores permite a usuarios remotos autenticados ejecutar código arbitrario como root a través de los campos de Dirección IP del Router de la página de configuración de red.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-10-02 CVE Reserved
2023-10-10 CVE Published
2024-09-18 CVE Updated
2024-09-18 First Exploit
2024-10-16 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://github.com/FzBacon/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection/blob/master/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection.md#cve-2023-27216_d-link_dsl-3782_router_command_injection	2024-09-18

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Dlink Search vendor "Dlink"	Dsl-3782 Firmware Search vendor "Dlink" for product "Dsl-3782 Firmware"	<= 1.03 Search vendor "Dlink" for product "Dsl-3782 Firmware" and version " <= 1.03"	-	Affected	in	Dlink Search vendor "Dlink"	Dsl-3782 Search vendor "Dlink" for product "Dsl-3782"	-	-	Safe