cbcvebase.
CVE-2023-43235
published 2023-09-21

CVE-2023-43235: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.

PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.04%
60.0th percentile
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.

Affected

1 ranges
VendorProductVersion rangeFixed in
dlinkdir-823g_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/HNAP1
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link SetWifiDownSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-43235)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1"; http.request_body; content:"|3c 3f|xml|20|version|3d 22|1.0|22|"; content:"|3c|SetWifiDownSettings"; fast_pattern; pcre:"/\x3c(?:StartTime|EndTime)\x3e[^\x3e]{100,}(?:\x3e|$)/"; reference:cve,2023-43235; classtype:web-application-attack; sid:2065145; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_10, cve CVE_2023_43235, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit traffic targets the HNAP1 endpoint via HTTP POST. Look for POST requests to /HNAP1 containing the XML body element <SetWifiDownSettings> with oversized (100+ character) <StartTime> or <EndTime> tag values.
  • →The overflow is triggered via the StartTime and EndTime parameters inside the SetWifiDownSettings SOAP/XML action on D-Link DIR-823G v1.0.2B05. ↗
  • →Traffic is expected in plaintext (not TLS); deploy detection at the network perimeter and internally on segments hosting networking equipment.
  • →MITRE mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190).
  • ·Affected product is specifically D-Link DIR-823G firmware version v1.0.2B05 only; other firmware versions are not confirmed vulnerable. ↗
  • ·The Snort/Suricata rule (sid:2065145) uses a PCRE matching payloads ≥100 characters in StartTime/EndTime tags; legitimate long values in those fields (if any) could produce false positives.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.