CVE-2024-23625 CRITICAL

CVE-2024-23625: D-Link DAP-1650 SUBSCRIBE Callback Command Injection Vulnerability

Vendor D-Link
Product DAP-1650
Weakness CWE-77
Published January 25, 2024
Last update May 29, 2025
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.

Key dates

02Disclosure timeline

January 25, 2024 CVE published
May 29, 2025 Record updated