CVE-2023-36089

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
d-link	dir-645_firmware	1.03

References

https://www.dlink.com/en/security-bulletin/Vendor Advisory
https://www.dlink.com/en/supportNot Applicable
https://www.dlink.com/en/security-bulletin/Vendor Advisory
https://www.dlink.com/en/supportNot Applicable

Timeline

Published: Jul 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-36097.8A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. CVE-2023-360909.8Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This CVE-2023-360919.8Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_CVE-2023-360929.8Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOT CVE-2023-360935.4There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management CVE-2023-360959.8An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affec CVE-2023-360979.8funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.CVE-2023-36107.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. CVE-2023-361009.8An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter CVE-2023-361039.8Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands CVE-2023-361067.5An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the inte CVE-2023-361099.8Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_ra