CVE-2023-5152

Name of the Vulnerable Software and Affected Versions D-Link DAR-7000 and DAR-8000 versions up to 20151231

Description A critical issue has been found in the /importexport.php file, where the manipulation of the sql argument leads to sql injection. This allows an attacker to execute arbitrary commands remotely. The exploit has been disclosed to the public. The issue affects products that are no longer supported by the maintainer and should be retired and replaced.

Recommendations For D-Link DAR-7000 and DAR-8000 versions up to 20151231, retire and replace the products as they are end-of-life and no longer supported by the maintainer. As a temporary workaround, consider restricting access to the /importexport.php file to minimize the risk of exploitation. Avoid using the sql argument in the affected file until the issue is resolved.