D-LINK DAR-7000 vulnerable to critical SQL Injection

The D-Link DAR-7000 device is vulnerable to SQL injection. Exploiting this flaw, attackers could potentially obtain administrative rights, letting them run unauthorized commands on affected devices. The vulnerability is tracked as CVE-2023-42406 (CVSS3 score of 9.8).

The DAR-7000 is a legacy router that's not sold on the US market.

A Proof-of-Concept (PoC) illustrating the exploit is published on GitHub. The vulnerability is present in the /sysmanage/editrole.php endpoint of the device, which is susceptible to SQL injection. To exploit this flaw, a hacker can send a specially designed payload, like

“hid_id=(select*from(select(sleep(3)))a)”

to the vulnerable endpoint, leading to a successful breach of the system.

Status of the model

D-Link products that reach End of Support ("EOS") or End of Life ("EOL") no longer receive development or customer support. D-Link US can't assist with issues related to these products. Customers outside the US should contact their regional D-Link office or their service provider if the device was supplied by them.

While some EOL products may have third-party open-firmware available, D-Link doesn't support this, and using it voids the warranty. D-Link advises retiring these products to avoid risks. If still in use, consumers should ensure the device runs the latest firmware from the Legacy Website and regularly update both the device's access password and enable WIFI encryption with a unique password.