D-Link has successfully removed a critical vulnerability in the router dsl-3788 that allowed remote code execution (RCE) without authentication. Discovered by researchers at Secure Network Bvtech, the vulnerability affected hardware revision B2 with firmware version V1.01R1b036_eu_en and below.
The vulnerability was found to be related to processing specially crafted SESSIONID values in the WebProc CGI component. An error in the Libssap library, due to the lack of input length verification in the “Comm_makeCustommsg” functions, resulted in buffer overflow, enabling attackers to execute arbitrary code on the device.
D-Link was made aware of the issue on November 25, 2024, and promptly initiated an investigation and developed a patch. The fix was released within 90 days of the vulnerability being detected.
Owners of the DSL-3788 model outside the United States are strongly advised to update their firmware to version V1.01R1B037. Before installing the update, users should verify that their device corresponds to the correction by checking the hardware revision number and firmware version on the device sticker or through the router’s web interface.
D-Link underscores the importance of timely software updates to safeguard devices against potential attacks. The company also cautions that beta versions of firmware used for emergency fixes undergo additional testing and do not guarantee complete stability.
For detailed instructions on how to install the updates, users can refer to this link.