CVE-2023-35724 is a high severity (CVSS 8.8) authentication bypass in the Telnet CLI of the D-Link DAP-2622 access point, caused by hardcoded credentials. A network-adjacent attacker on the same network can skip login entirely. D-Link lists the v1.10B03R022 beta hotfix as the fix.
What's affected
D-Link announcement SAP10349 lists the DAP-2622, all A series hardware revisions, non-US and non-Canada region, with firmware v1.00 and below affected. The fixed firmware is v1.10B03R022 Beta-Hotfix, supplied as is by D-Link and still undergoing final testing. The announcement lists 52 vulnerabilities by ZDI tracking number and no CVE ids, and it does not state an end-of-life status for the model.
The record and ZDI agree on 8.8 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-798, use of hard-coded credentials, in the CLI service that listens on TCP port 23 (ZDI-CAN-20050). The record's KEV flag is false.
How to check if you're exposed
- Log in to the access point's web page and read the firmware version. v1.00 or below is affected.
- Confirm the model is a DAP-2622 and note the hardware revision on the label.
- From a machine on the same network, check whether TCP port 23 answers, for example with a port scanner you are authorised to use against your own devices.
- Inventory every DAP-2622 in offices and warehouses, since access points are easy to forget.
What to do now
- Install firmware v1.10B03R022 Beta-Hotfix after confirming the hardware revision. Back up the configuration first.
- Disable Telnet if the device allows it, and block TCP port 23 to the device at your switch or firewall.
- Put management traffic on a separate, restricted VLAN.
- Plan to replace the unit if D-Link does not issue a final release.
Why it matters
Hardcoded credentials are a secret baked into firmware. Anyone who learns the value can use it on every device running that firmware, and the owner cannot change it. Once found, it works across the whole product line.
Here the secret guards a management shell. Access to the CLI of an access point can let an attacker change settings or read stored data. The advisory also lists 51 other issues for this model, including many buffer overflows, so the beta hotfix matters beyond this one CVE.
Quick check
Can I change the hardcoded password myself?
The advisory describes it as hard-coded in the CLI service, so changing the admin password in the web page is not described as a fix. Apply the firmware update and block Telnet.
What is the fixed firmware?
v1.10B03R022 Beta-Hotfix per D-Link, with final testing still under way.
Sources
Last reviewed: 19 October 2026.
