CVE-2023-5143 - Critical Vulnerability in End-of-Life D-Link DAR-700 Routers (VDB-240239)

A critical security flaw, CVE-2023-5143, has been discovered in the D-Link DAR-700 router up to firmware dated 2015-12-31. This bug is especially urgent for organizations or individuals who might still be using this now-unsupported device. The vulnerability centers around improper handling of user input in the /log/webmailattach.php file, specifically through the table_name parameter.

Remote Exploitation: Attackers can remotely exploit this weakness.

- Critical Level: The vulnerability is rated “critical” due to its exploitation ease and potential impact.

What Is CVE-2023-5143?

This CVE documents a vulnerability in how the table_name argument is processed by /log/webmailattach.php on the D-Link DAR-700. Since the router doesn't properly sanitize this input, malicious actors can inject unexpected code or commands, which could give them unauthorized control or access.

Affected product: D-Link DAR-700 (up to 20151231 firmware)

- Vulnerable file: /log/webmailattach.php

Exploit Details

While exact internal code from D-Link isn't available, analysis of the exploit published in the wild shows the flaw can be abused with a simple, remote HTTP request.

Below is a simplified version of what the vulnerable code may look like

<?php
// webmailattach.php (simplified)
$table = $_GET['table_name'];
$sql = "SELECT * FROM $table";
$result = mysqli_query($conn, $sql);
// ... rest of the code ...
?>

Notice the lack of input validation or parameterized queries. This opens the possibility for SQL Injection, leading to data theft, modification, or device takeover.

A typical attack can be performed like this with curl or in the browser

curl "http://[router-ip]/log/webmailattach.php?table_name=users;--";

Or a more dangerous payload

curl "http://[router-ip]/log/webmailattach.php?table_name=users; DROP TABLE users;--"

Depending on the backend and permissions, attackers could

- Steal configuration/user data

Gain remote shell access (in rare cases)

Note: The specifics depend on other parts of the code — this example highlights the typical vector.

Public References and Details

- Original VulDB Entry (VDB-240239)
- CVE Details Page
- Exploit Database (mirror) — Search by CVE number for PoC scripts

How to Protect Yourself

There is no patch, firmware update, or official fix for this vulnerability because the product has reached end-of-life.

Retire and Replace It: Immediately switch to a modern, supported router.

2. Remove Internet Exposure: If replacement is not yet possible, limit device access to only trusted internal networks.

Monitor Network Traffic: Watch for unusual connections to the device.

4. Change Default Passwords: If you haven’t done so, change all admin passwords (though this won’t fix the vulnerability).

Conclusion

CVE-2023-5143 is a prime example of why keeping network equipment up-to-date and supported is absolutely vital. Once support ends, your risk dramatically increases — not just because no one will fix bugs, but because attackers know there’s no defense.

Action: If you have a D-Link DAR-700 (regardless of firmware), you *must* replace it as soon as possible. Continuing to use this router exposes your network to critical, remotely exploitable risks.

*Stay safe online! Replace old hardware and check the security status of every network device you manage.*

Timeline

Published on: 09/24/2023 23:15:10 UTC
Last modified on: 11/07/2023 04:23:30 UTC

CVE-2023-5143 - Critical Vulnerability in End-of-Life D-Link DAR-700 Routers (VDB-240239) — Exploit Details and Remediation Advice