CVE-2023-27216
Published: 12 April 2023
Summary
CVE-2023-27216 is a high-severity OS Command Injection (CWE-78) vulnerability in Dlink Dsl-3782 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-27216 is an OS command injection issue (CWE-78) present in the D-Link DSL-3782 router running firmware version 1.03. It resides in the network settings page and received a CVSS 3.1 base score of 8.8.
Remote authenticated users can exploit the flaw over the network without user interaction to execute arbitrary code as root, resulting in full compromise of device confidentiality, integrity, and availability.
D-Link references a security bulletin on its site for this issue, while independent analysis is available at lessonsec.com. The associated EPSS score reached a peak of 0.3621 and currently stands at 0.2776.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30996
Vulnerability details
An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.