CVE-2023-32224CWE-307

D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts

Critical · published June 28, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
72.3
In the wild
Unconfirmed
What it is

🔥 A critical flaw in D-Link DSL-224's firmware could let attackers bombard your device with endless login attempts! Think of it like a bank without security guards at its doors, allowing anyone to keep trying different keys until they find one that works. In this case, malicious users can brute-force their way in without breaking a sweat! If successfully exploited, this vulnerability could allow an attacker to gain unauthorized access to the router's settings. This means they could change configurations, hijack your network, or even intercept sensitive data. The potential consequences are absolutely devastating!

Put simply

Think of it like a bank without security guards at its doors, allowing anyone to keep trying different keys until they find one that works. In this case, malicious users can brute-force their way in without breaking a sweat! CVE-2023-32224 arises from improper restrictions on excessive authentication attempts, allowing attackers to perform a brute force attack on the device's login interface without triggering any protective measures.

What to do

If successfully exploited, this vulnerability could allow an attacker to gain unauthorized access to the router's settings. This means they could change configurations, hijack your network, or even intercept sensitive data. The potential consequences are absolutely devastating! To secure your D-Link DSL-224, immediately upgrade the firmware to version 3.0.11 or later. Additionally, implement strong login credentials and consider enabling account lockout policies to thwart excessive attempts. Don't wait! You've got this! Follow these steps and you'll have your network protected in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01399 · 72.3th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2023-06-28T00:00Z
EPSS history
Timeline
  • 28 JUN 00:00Z
    D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts
    cvelistv5