CVE-2023-35755 is a high severity (8.8) stack overflow in the D-Link DAP-2622 DDP service, triggered through the authentication username in a Set Date-Time request. D-Link lists beta hotfix firmware v1.10B03R022 for affected non-US and non-Canada units on v1.00 or below.
What's affected
The record lists the D-Link DAP-2622 access point and its firmware. It does not give version numbers, so the vendor announcement is the source for them.
D-Link announcement SAP10349 covers the DAP-2622, all hardware revision A series units, non-US and non-Canada region. It lists v1.00 and below as affected and v1.10B03R022 as the fixed firmware. D-Link marks that release as a beta hotfix that was still in final testing when it published the notice, last updated 24 August 2023. Units sold in the US and Canada are not named, so if you run one, ask D-Link support whether it is covered.
The same announcement bundles 52 reports from Trend Micro's Zero Day Initiative against this one device, many of them stack overflows in the DDP service. This CVE is one of them, tracked by ZDI as ZDI-23-1260 (ZDI-CAN-20083). Patching for one means patching for all, because the fix ships as a single firmware image.
How to check if you're exposed
You need the firmware version and the hardware revision of each DAP-2622. There is no package manager here, so the check is done in the device itself.
- Sign in to the access point's web administration page from a trusted wired machine.
- Open the status or firmware information page and note the firmware version and hardware revision.
- Compare them with the table in D-Link announcement SAP10349. Revision A with v1.00 or below, sold outside the US and Canada, is in the affected set.
If you manage many access points, pull the firmware field from your asset inventory or controller export instead of logging in to each one. Anything you cannot account for is worth finding, because forgotten access points in storerooms and meeting rooms are where old firmware tends to sit.
A dependency scanner will not see this. It reads manifests and lockfiles for software you build, not the firmware inside a network device.
What to do now
- List every DAP-2622 on your network and record its firmware version, hardware revision and sales region.
- Download the v1.10B03R022 firmware from D-Link's support site for the units named in SAP10349, and read the beta notice before you apply it. D-Link states the beta is provided as is.
- Schedule the update for a maintenance window and keep the previous firmware image so you can roll back if the beta misbehaves.
- Until a unit is patched, limit who can reach it. The flaw is described as network-adjacent, so keep guests, IoT devices and untrusted laptops off the segment the access point is managed from.
- Ask D-Link whether a final, non-beta release has replaced the hotfix, and plan to move to it when it exists.
- If a unit is out of support or cannot be updated, plan its replacement.
Why it matters
This is a classic memory safety bug. The DDP service copies username field in a Set Date-Time request into a fixed-size buffer on the stack without checking its length first. The weakness classes are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). Send more data than the buffer holds and it overwrites neighbouring memory, which can let an attacker take control of the process.
The record rates it 8.8 with a network-adjacent vector, no privileges and no user interaction. The advisory text says an attacker could run code as root. That is why the score is high even though the attacker must be on the same network segment. It is not listed in CISA's Known Exploited Vulnerabilities catalogue, and none of the pages I read claim exploitation in the wild.
Network gear is easy to forget in patch cycles. It rarely shows up in application scans, and nobody gets an alert when its firmware ages. Treat it as inventory: know what you have, what version it runs and who owns the update.
Quick check
Does this need a login to the access point?
No. The record says authentication is not required. The attacker does need to be network-adjacent, meaning on the same network segment as the device.
Is the fix a stable release?
D-Link describes v1.10B03R022 as a beta hotfix that was still undergoing final testing at the time of the notice. Check the announcement for a later release before you roll it out widely.
Sources
- D-Link announcement SAP10349
- Zero Day Initiative advisory ZDI-23-1260
- Safeguard Gold entry for CVE-2023-35755
Last reviewed: 19 October 2026.
