CVE-2023-45208

Name of the Vulnerable Software and Affected Versions D-Link DAP-X1860 versions 1.00 through 1.01b05-01

Description A command injection exists in the parsing xml stasurvey() function within the libcgifunc.so library. This issue occurs due to insufficient escaping of the SSID (Service Set Identifier) of an access point. An attacker within range of the repeater can use a crafted SSID to execute shell commands with root privileges during the repeater setup process. Additionally, network names containing single quotes can cause a denial of service.

Recommendations Update D-Link DAP-X1860 versions 1.00 through 1.01b05-01 to the fixed version provided by the manufacturer.