CyberSecBulletin
CVE-2022-38873NVD status: Modified

Dap-2310 Firmware: Insufficient Verification of Data Authenticity

Published Updated By the CyberSecBulletin desk

CVE-2022-38873 is a high-severity insufficient verification of data authenticity vulnerability in Dap-2310 Firmware from D-Link, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Dap-2310 Firmware versions: 2.10rc036 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Dap-2695 Firmware to 1.20rc119 or a later version.
  2. Update Dap-3320 Firmware to 1.05rc027 or a later version.
  3. Read the advisory on dlink.com for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
D-LinkDap-2310 Firmware2.10rc036 and earlierNot stated
D-LinkDap-2330 Firmware1.06rc020 and earlierNot stated
D-LinkDap-2360 Firmware2.10rc050 and earlierNot stated
D-LinkDap-2553 Firmware3.10rc031 and earlierNot stated
D-LinkDap-2660 Firmware1.15rc093 and earlierNot stated
D-LinkDap-2690 Firmware3.20rc106 and earlierNot stated
D-LinkDap-2695 Firmwarebefore 1.20rc119; 1.20rc1191.20rc119
D-LinkDap-3320 Firmwarebefore 1.05rc027; 1.05rc0271.05rc027
D-LinkDap-3662 Firmware1.05rc047 and earlierNot stated

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighNVD
CVSS 3.17.5HighCISA (ADP)

Official description

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

More Insufficient Verification of Data Authenticity vulnerabilities (CWE-345)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other vulnerabilities in Dap-2310 Firmware

All Dap-2310 Firmware vulnerabilities

Recent Insufficient Verification of Data Authenticity vulnerabilities

Spotted an error? Tell us.