CVE-2023-37317: High Stack Overflow in D-Link DAP-2622 DDP

CVE-2023-37317 is a high severity stack-based buffer overflow (CVSS 8.8) in the DDP service of the D-Link DAP-2622 access point, via the primary DNS field of the Set IPv6 Address request. D-Link offers beta hotfix firmware v1.10B03R022, so test it and install it as soon as you can.

What's affected

• Product: D-Link DAP-2622 wireless access point, all A-series hardware revisions, non-US/CA region, firmware v1.00 and below, per D-Link advisory SAP10349.
• Fixed version: firmware v1.10B03R022. D-Link labels it a beta hotfix, provided as is, with the user accepting the risk. The advisory page does not say whether the model has reached end of life.
• Severity: High, CVSS 8.8, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Zero Day Initiative also lists 8.8, using CVSS 3.0.
• Exploited in the wild: the record's CISA KEV flag is false.
• Disclosure: Zero Day Initiative says it was reported to the vendor on 2023-01-20 and publicly released on 2023-08-25 as ZDI-23-1271.

This is one of ten related CVEs, CVE-2023-37310 to CVE-2023-37319, covering the same kind of flaw in different fields handled by the DDP service. The one here concerns the primary DNS field of the Set IPv6 Address request. The record text says that authentication is not required to exploit it. The word Auth in some of these names refers to a protocol field, not to a login requirement.

How to check if you're exposed

Check the model and firmware on each access point. The hardware revision is on the label under the device and in the web interface, and D-Link says to confirm it before you download firmware.

• Open the access point's web interface and read the firmware version on the status or system page.
• Check the model on the label. Only DAP-2622 A-series, non-US/CA region units are listed.
• If you manage a fleet, export the firmware version from your wireless controller or inventory.

Firmware v1.00 or lower is in the affected range. Anything running v1.10B03R022 or later is on the fixed build D-Link lists.

What to do now

1. Inventory every DAP-2622 and note its hardware revision and region.
2. Read D-Link advisory SAP10349 and download v1.10B03R022 for your hardware revision. Remember that D-Link supplies it as a beta hotfix, so test it on one unit first.
3. Because the attack vector is the adjacent network, make sure the access point's management and DDP traffic is limited to trusted network segments. Do not expose it to guest or untrusted networks.
4. Back up the configuration before upgrading.
5. If you cannot apply a beta firmware, plan for replacing the device, and ask D-Link about support status for the model.

Why it matters

The weakness classes are CWE-121, a stack-based buffer overflow, and CWE-787, an out-of-bounds write. The ZDI advisory says the service does not properly validate the length of user-supplied data before copying it into a fixed-length stack buffer. That mistake is among the oldest in C code, and on a device that runs services as root it is serious.

The ZDI text says an attacker could execute code in the context of root, from the adjacent network and without credentials. Wireless infrastructure is often installed once and left alone, so an access point can run old firmware for years. That makes the patch, and the network placement of management traffic, the two things to get right.

Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.

Quick check

Sources

• NVD record for CVE-2023-37317
• Safeguard Gold page
• D-Link advisory SAP10349
• Zero Day Initiative advisory ZDI-23-1271 (the shared advisory text for this CVE was reviewed through ZDI-23-1264, the first of the series)

Last reviewed: 19 October 2026.