CVE-2023-43241

published 2023-09-21

CVE-2023-43241: D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-823g_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWLanRadioSecurity/1.md

path /HNAP1

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2023-43241)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/HNAP1"; http.request_body; content:"|3c 3f|xml|20|version|3d 22|1.0|22|"; content:"|3c|SetWLanRadioSettings"; fast_pattern; pcre:"/\x3c(?:TXPower|GuardInt)\x3e[^\x3e]{100,}(?:\x3e|$)/"; reference:url,github.com/peris-navince/founded-0-days/blob/main/Dlink/823G/SetWLanRadioSecurity/1.md; reference:cve,2023-44839; reference:cve,2023-43241; classtype:web-application-attack; sid:2065141; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_10, cve CVE_2023_44839_CVE_2023_43241, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|3c 3f|xml|20|version|3d 22|1.0|22|

bytes

|3c|SetWLanRadioSettings

• → Exploit traffic is plaintext HTTP POST to /HNAP1; look for oversized (100+ chars) XML values in <TXPower> or <GuardInt> tags within a SetWLanRadioSettings SOAP body
• → Stack overflow is triggered via parameters TXPower and GuardInt in the SetWLanRadioSecurity handler on D-Link DIR-823G v1.0.2B05 ↗
• → MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application; deploy detection at network perimeter and internally

• · Snort/Suricata rule (sid:2065141) targets plaintext HTTP only (tls_state plaintext); encrypted HTTPS traffic to the HNAP1 endpoint will not be detected by this signature

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787