CVE-2023-33735
Published: 31 May 2023
Summary
CVE-2023-33735 is a critical-severity an unspecified weakness vulnerability in Dlink Dir-846 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-846 firmware version 1.00A52 contains a remote command execution vulnerability in the tomography_ping_address parameter of the /HNAP1 interface. The flaw received a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction, with full impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can supply a crafted value to the affected parameter and execute arbitrary commands on the device. Successful exploitation grants complete control over the router, enabling actions such as configuration changes, traffic interception, or use of the device in further attacks.
D-Link has published a security bulletin addressing the issue, while public references also include a detailed vulnerability description hosted on GitHub. The EPSS score for this CVE rose from a low baseline to a peak of 0.7478 on 2026-02-03 before receding to the current value of 0.2505, indicating a clear increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37888
Vulnerability details
D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.