CVE-2023-35750

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35750

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

D

-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078.

References
Link Resource
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Vendor Advisory Patch
https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 Vendor Advisory Patch
https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
History

13 May 2025, 13:54

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Dlink dap-2622
Dlink dap-2622 Firmware
Dlink
CVSS v2 : unknown
v3 : 7.4 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:h:dlink:dap-2622:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-2622_firmware:*:*:*:*:*:*:*:*
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - Vendor Advisory, Patch
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - Third Party Advisory

21 Nov 2024, 08:08

Type Values Removed Values Added
References () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 - () https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10349 -
References () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-1255/ -

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary (en) D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-20078. (en) D-Link DAP-2622 DDP Get SSID List WPA PSK Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. . Was ZDI-CAN-20078.

03 May 2024, 12:50

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2025-05-13 13:54

NVD link : CVE-2023-35750

Mitre link : CVE-2023-35750

CVE.ORG link : CVE-2023-35750

JSON object : View

Products Affected

dlink

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo