CVE-2023-32143
D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of requests to the /cgi-bin/webupg endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18423.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.53%
- CWE
- CWE-197
- Published
- 2024-05-03
- Last modified
- 2026-03-13
Affected products
- D-Link DAP-1360
Weakness type
Related vulnerabilities
- CVE-2022-42475 — A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0
- CVE-2026-87529 — Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execu
- CVE-2020-15202 — Integer truncation in Shard API usage
- CVE-2022-34670 — NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged reg
- CVE-2025-6965 — Integer Truncation on SQLite
- CVE-2026-6679 — DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
- CVE-2026-42944 — Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
- CVE-2026-73523 — COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation