CVE-2023-35744

HIGH

D-Link DAP-2622 Firmware < 1.10b03r022 - Unauthenticated Stack-based Buffer Overflow in DDP Configuration Restore

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-35744. PoCs published by ADSSA-IT.

AI-analyzed exploit summary The repository contains only a minimal README file with a CVE title and no exploit code, technical details, or proof-of-concept. It lacks any actionable information or payload.

Description

D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20071.

Exploits (1)

nomisec STUB
by ADSSA-IT · poc
https://github.com/ADSSA-IT/CVE-2023-35744

The repository contains only a minimal README file with a CVE title and no exploit code, technical details, or proof-of-concept. It lacks any actionable information or payload.

Classification
Stub 10%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory x_research-advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1249/

Scores

CVSS v3 8.8
EPSS 0.0245
EPSS Percentile 82.5%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-121 CWE-787
Status published
Products (1)
dlink/dap-2622_firmware < 1.10b03r022
Published May 03, 2024
Tracked Since Feb 18, 2026