CVE-2023-42406

Summary

CVE-2023-42406 is a newly identified SQL injection vulnerability affecting D-Link's Online Behavior Audit Gateway DAR-7000 V31R02B1413C. This issue allows remote attackers to gain unauthorized access to sensitive information and execute arbitrary code through the editrole.php component. By injecting malicious SQL queries, an attacker can bypass input validations and manipulate the database, potentially resulting in data theft or system compromise. This vulnerability poses a significant risk to organizations using the affected device, necessitating immediate patches or mitigations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.