CVE-2023-0127

2023-02-1118:15:11

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-0127

firmware_update

command injection

telnet interface

authenticated attacker

arbitrary commands

root access

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

76.7%

JSON

A command injection vulnerability in the firmware_update command, in the device’s restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.

Affected configurations

NVD

Node

dlinkdwl-2600apMatch-

AND

dlinkdwl-2600ap_firmwareMatch4.2.0.17

CPENameOperatorVersion
dlink:dwl-2600ap_firmwaredlink dwl-2600ap firmwareeq4.2.0.17

CPE	Name	Operator	Version
dlink:dwl-2600ap_firmware	dlink dwl-2600ap firmware	eq	4.2.0.17

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "D-Link DWL-2600AP with firmware v4.2.0.17",
    "versions": [
      {
        "version": "DWL-2600AP with firmware version v.4.2.0.17",
        "status": "affected"
      }
    ]
  }
]