CVE-2023-35743 is a high severity (CVSS 8.8) stack-based buffer overflow affecting the D-Link DAP-2622, in the DDP Configuration Restore Auth Password part of its DDP service. No authentication is needed from a network-adjacent attacker. D-Link offers firmware v1.10B03R022 Beta-Hotfix as the remedy.
What's affected
D-Link announcement SAP10349 lists the DAP-2622, all A series hardware revisions, non-US and non-Canada region, with firmware v1.00 and below affected. The fixed firmware is v1.10B03R022 Beta-Hotfix, supplied as is by D-Link and still undergoing final testing. The announcement lists 52 vulnerabilities by ZDI tracking number and no CVE ids, and it does not state an end-of-life status for the model.
This CVE covers the DDP Configuration Restore Auth Password case, tracked by ZDI as ZDI-CAN-20070. The record and the ZDI advisory ZDI-23-1231 for the sibling issue CVE-2023-35725 agree on 8.8 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-121, a stack-based buffer overflow. The record's KEV flag is false.
How to check if you're exposed
- Sign in to the access point's web interface and read the firmware version. v1.00 or below is affected.
- Confirm the model is a DAP-2622 and note the hardware revision from the label.
- List every DAP-2622 on your networks, including those installed years ago in meeting rooms or stockrooms.
- Check which segments can reach the device's management services, because the attacker must be on an adjacent network.
This is device firmware, so a package scan will not find it. Use your asset inventory.
What to do now
- Install firmware v1.10B03R022 Beta-Hotfix after confirming the hardware revision, and back up the configuration first.
- Restrict the access point's management and discovery services to a trusted management VLAN.
- Keep guest and IoT devices off the segment where the access point is managed.
- If D-Link publishes a final release, move to it. If the model is no longer supported, plan its replacement.
Why it matters
The record describes a lack of proper validation of the length of user-supplied data before it is copied to a fixed-length stack buffer. The record states that no authentication is required to reach it. The code runs as root, so success hands over the whole device.
This CVE is one of many from the same family. D-Link's announcement covers dozens of DDP overflows that differ only by the function and field involved, so one firmware update closes them together. Track each CVE id in your records, but patch once.
Quick check
Is CVE-2023-35743 different from the other DAP-2622 overflows?
It covers the DDP Configuration Restore Auth Password case. The cause is the same, so the same hotfix addresses it, according to D-Link's single announcement.
Do I need credentials to be attacked?
The record says authentication is not required, and the attacker must be on an adjacent network.
Sources
Last reviewed: 19 October 2026.
