CVE-2023-43284
Published: 05 October 2023
Summary
CVE-2023-43284 is a high-severity an unspecified weakness vulnerability in Dlink Dir-846 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-43284 affects D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices. The flaw permits an authenticated remote attacker to execute arbitrary code through manipulation of the QoS POST parameter, carrying a CVSS 3.1 base score of 8.8 reflecting network attack vector, low complexity, and full confidentiality, integrity, and availability impact.
An attacker who already possesses valid credentials on the affected router can send a crafted QoS POST request to achieve remote code execution without further user interaction. The references consist of a public GitHub repository and demonstration video that document the issue, but no vendor advisory or patch information is provided.
The associated EPSS score stands at 0.3815.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47703
Vulnerability details
D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.