CVE-2023-48842

The vulnerability is located in a CGI script named hedwig.cgi, which processes HTTP requests without proper validation of the 'service' parameter. An attacker can place malicious system commands in this parameter, which will be executed by the device with the privileges of the process handling the request. The attack does not require authentication or user interaction, and can be executed remotely over the network.

An attacker can gain full control over the device by executing arbitrary system commands — leading to violations of confidentiality, integrity, and system availability. Possible consequences include device takeover, network configuration changes, and using the router as an entry point to the local network (lateral movement).

Patches available from the manufacturer should be applied according to references. If an update is not available, it is recommended to restrict access to the device's administrative interface exclusively to trusted local networks and disable access to the management panel from the WAN network.

D-Link Go-RT-AC750 revA_v101b03 (firmware)