{"id":"CVE-2024-23625","published":"2024-01-25T23:41:20Z","modified":"2025-05-29T15:18:31Z","title":"D-Link DAP-1650 SUBSCRIBE Callback Command Injection Vulnerability","vendor":"D-Link","product":"DAP-1650","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-Link","product":"DAP-1650","versions":["<= 1.04B01"]}],"description":{"text":"A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The D-Link DAP-1650 has a command injection flaw in how its firmware handles UPnP SUBSCRIBE messages. An unauthenticated attacker who can send such messages to the device, with no user interaction needed, can execute commands as root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:25Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.07292,"percentile":0.94348,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-05","exploitedFirstSeen":"2026-10-05","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure","date":"2026-10-05"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6ad1a6eb3af1f746d2dbb6fe","created":"2026-10-16"},{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6acf7922d9bc17d95d27ec5c","created":"2026-10-14"},{"name":"ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure","url":"https://otx.alienvault.com/pulse/6ac5dad2d26bfc1feceecb90","created":"2026-10-07"},{"name":"ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access","url":"https://otx.alienvault.com/pulse/6ac4c5b172d0180a9464f655","created":"2026-10-06"},{"name":"ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | FortiGuard Labs","url":"https://otx.alienvault.com/pulse/6ac494f5a339254349f399a9","created":"2026-10-06"},{"name":"ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure","url":"https://otx.alienvault.com/pulse/6ac4285a7c6e1cd492e8b2cf","created":"2026-10-05"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-subscribe-callback-command-injection-vulnerability/","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-21119","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21119","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-01-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-23625","provenance":"source"},{"date":"2026-10-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":72.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 25 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.87,"detail":"percentile 0.9435"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}