CVE-2023-33782

Deeper analysis

D-Link DIR-842V2 firmware version 1.0.3 contains a command injection vulnerability in its iperf3 diagnostics function. The flaw is tracked as CVE-2023-33782, carries a CVSS 3.1 score of 8.8, and is categorized under CWE-77. It allows an attacker to supply crafted input that is executed directly by the underlying operating system.

An authenticated user with network access can trigger the flaw without user interaction, resulting in arbitrary command execution on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and to disrupt device operation, consistent with the high impact ratings across confidentiality, integrity, and availability.

Public references point to a D-Link security bulletin page and a proof-of-concept repository that demonstrates the issue. No specific patch version or mitigation steps are detailed in the supplied references. The associated EPSS score currently stands at 0.5194 with a recorded peak of 0.5221, indicating sustained exploitation interest since disclosure.