CVE-2023-42406
Published: 26 October 2023
Summary
CVE-2023-42406 is a critical-severity SQL Injection (CWE-89) vulnerability in Dlink Dar-7000 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-42406 is a SQL injection vulnerability (CWE-89) affecting the D-Link Online behavior audit gateway DAR-7000 running firmware V31R02B1413C. The flaw resides in the editrole.php component and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to editrole.php to extract sensitive data or execute arbitrary code on the device. Successful exploitation grants the attacker complete control over the affected gateway without prior authentication.
Public references consist of GitHub repositories that document the injection vector and provide reproduction details; no vendor advisory, patch information, or official mitigation guidance appears among the listed sources. The associated EPSS score reached a peak of 0.2705 and currently stands at 0.2129.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46858
Vulnerability details
SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.