CVE-2023-5151

Deeper analysis

CVE-2023-5151 is a SQL injection vulnerability, tracked as CWE-89, that affects an unknown function in the file /autheditpwd.php of the D-Link DAR-8000 router firmware up to version 20151231. The flaw is triggered by unsanitized input to the hid_id parameter and carries a CVSS 3.1 score of 6.3. The CVE record is explicitly marked “UNSUPPORTED WHEN ASSIGNED” because the product reached end-of-life in 2015 and is no longer supported by the vendor.

An authenticated attacker with low privileges can send a crafted HTTP request to the affected endpoint from a remote network location. Successful exploitation allows the attacker to execute arbitrary SQL statements, resulting in limited disclosure, modification, or disruption of data within the device’s database.

D-Link’s support announcement SAP10354 and the associated vendor statement confirm that the DAR-8000 series is end-of-life; the vendor recommends immediate retirement and replacement rather than patching. Public exploit code has been published on GitHub, and the vulnerability record is mirrored on VulDB.

The EPSS score has remained near 0.20 with only a negligible peak-to-current difference, indicating no material post-disclosure surge in observed exploitation interest.