CVE-2023-53896
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dap-1325_firmware | 1.01 |
| dlink | dap-1325 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a broken access control flaw in the D-Link DAP-1325 device firmware version 1.01. It allows unauthenticated attackers to download the device's configuration settings by accessing the /cgi-bin/ExportSettings.sh endpoint without needing to log in or authenticate. Essentially, anyone who can reach the device can retrieve sensitive configuration information directly. [2]
How can this vulnerability impact me? :
This vulnerability can impact you by exposing sensitive device configuration settings to unauthorized parties. Attackers can download these settings without authentication, potentially gaining information that could be used to compromise the device or network security. This could lead to further attacks or unauthorized access to your network. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting to access the vulnerable endpoint on the device's IP address. For example, use a command like: curl http://<device-ip>/cgi-bin/ExportSettings.sh. If the device returns configuration settings without requiring authentication, it is vulnerable. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to download sensitive device configuration settings, which may include personal or sensitive information. This exposure could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access. Therefore, exploiting this vulnerability could result in violations of these standards due to inadequate access controls and potential data breaches. [2]