CVE-2023-37323 is a high severity (CVSS 8.8) stack-based buffer overflow in the DDP service of the D-Link DAP-2622 wireless access point. D-Link lists beta hotfix firmware v1.10B03R022 as the fix for the non-US and Canada Ax hardware revisions. Check your firmware version and upgrade.
What's affected
The NVD record describes the flaw as a stack-based buffer overflow in the DDP service of the DAP-2622, reached through the PSK field of a Set SSID List request. The weakness classes are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). The vendor reference is ZDI advisory ZDI-23-1277, tracked by the researchers as ZDI-CAN-20101.
D-Link's announcement SAP10349 covers the non-US and non-Canada DAP-2622, all A series hardware revisions, with firmware v1.00 and below affected. The fixed firmware it lists is v1.10B03R022. D-Link labels that build a beta hotfix, so it states that it is still under final testing and supplied as is. The NVD record does not list version ranges, so the D-Link announcement is the better guide to which units are in scope.
How to check if you're exposed
There is no package manager query for a router, so the check is on the device.
- Find the hardware revision on the product label on the underside of the unit. D-Link says the Ax revision is the one covered.
- Open the device's web configuration and read the firmware version. Anything at v1.00 or below is in the affected range named by the vendor.
- Confirm which region your unit was sold for. The announcement is for the non-US and non-Canada model.
- Read SAP10349 again before downloading anything. It is the source for the fixed build and any later change to the recommendation.
What to do now
- Download the correct firmware for your hardware revision from the D-Link announcement page and install it. Read the beta hotfix notice first, and test on one unit before a wider rollout.
- Keep the access point management network separate from user and guest traffic. The record says an attacker must be network-adjacent, so who can reach the device matters.
- Record every DAP-2622 you run in an asset list with its firmware version, so the next advisory takes minutes to check.
- Watch the D-Link announcement for a final release that replaces the beta hotfix.
Why it matters
The record puts the attack vector as adjacent network, with low complexity, no privileges and no user interaction. The attacker does not need to log in. The flaw sits in the DDP service, which does not check the length of data it receives before copying it into a fixed-length buffer on the stack. The record says code would run as root.
This one is part of a larger batch. D-Link's announcement lists dozens of ZDI findings for the same model, many of them the same class of overflow in other fields of the DDP service. Patching one CVE from the list means little unless the firmware you install addresses the whole announcement. The record does not mark this CVE as known exploited, and the advisories I checked do not say it is exploited in the wild.
The same discipline applies to any device: keep an inventory, match versions against advisories, and re-check when the vendor updates its notice. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Do I need to be on the same network to be attacked?
The record gives the vector as adjacent network, so an attacker needs to reach the device from the same local segment. That is why separating management traffic is a sensible step while you schedule the update.
Sources
Last reviewed: 19 October 2026.
