Vulnerability record · CVE-2023-5151 · published 25 September 2023
CVE-2023-5151: D-Link DAR-8000 autheditpwd.php SQL injection via hid_id
Dlink · Dar 8000 Firmware
D-Link DAR-8000 firmware up to 20151231 contains a SQL injection in /autheditpwd.php where the hid_id argument is not properly sanitized. The flaw is rated critical and a public exploit exists, but the product is end-of-life and no longer supported by the vendor, so no fix will be issued.
Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityPublic exploit and very high EPSS probability, but exploitation requires authentication and the affected product is end-of-life with no patch available.
What it is
D-Link DAR-8000 firmware up to 20151231 contains a SQL injection in /autheditpwd.php where the hid_id argument is not properly sanitized. The flaw is rated critical and a public exploit exists, but the product is end-of-life and no longer supported by the vendor, so no fix will be issued.
Impact
An authenticated remote attacker can inject SQL through hid_id to read or modify database contents, potentially leading to full compromise of confidentiality, integrity and availability of the device.
Attack surface
Reachable over the network via HTTP requests to /autheditpwd.php; the CVSS vector indicates low privileges are required (PR:L) and no user interaction is needed.
Exploitation
A public exploit is referenced and EPSS is very high (0.81451, 99.6th percentile), but the CVE is not listed in CISA KEV and no ransomware usage is documented.
What to do
- Retire and replace the D-Link DAR-8000, as the vendor confirmed the product is end-of-life and unsupported.
- If retirement is not immediately possible, isolate the device on a management VLAN with no internet exposure and restrict access to trusted administrators.
- Remove or disable the /autheditpwd.php endpoint if it is not required for operations.
- Apply input validation or a WAF rule blocking SQL metacharacters in the hid_id parameter as a temporary compensating control.
- Monitor vendor advisory SAP10354 for any further guidance.
Detection
- Inspect HTTP request logs for /autheditpwd.php with suspicious hid_id values containing SQL keywords or metacharacters.
- Alert on SQL error strings or unexpected database responses returned by the DAR-8000 web interface.
- Monitor for anomalous authentication or configuration changes on the device following requests to autheditpwd.php.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20autheditpwd.md | ExploitThird Party Advisory |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354 | Vendor Advisory |
| https://vuldb.com/?ctiid.240247 | Third Party Advisory |
| https://vuldb.com/?id.240247 | Third Party Advisory |
| https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20autheditpwd.md | ExploitThird Party Advisory |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354 | Vendor Advisory |
| https://vuldb.com/?ctiid.240247 | Third Party Advisory |
| https://vuldb.com/?id.240247 | Third Party Advisory |
Track CVE-2023-5151 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-5151), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
