CVE-2023-41603 Misconfiguration in n/a
Attackers can bypass firewall restrictions to access internal services on D-Link R15 routers via IPv6 due to missing traffic rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41603?
CVE-2023-41603 is a medium-severity vulnerability in n/a, published on 10 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.
Weakness: CWE-284
Which versions are affected by CVE-2023-41603?
It affects 1 product.
Products include Dlink R15 Firmware.
How do I fix CVE-2023-41603?
No fix has been published for CVE-2023-41603 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41603 being exploited?
There is no known exploitation of CVE-2023-41603 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x24r-vvq6-349r.