CVE-2023-44694

The D-Link DAR-7000 behavior-audit gateway exposes a SQL injection point at /log/mailrecvview.php: attacker-controlled input reaches a database query unfiltered, and the request is remote and unauthenticated. From there an attacker can read or manipulate the gateway's database — including, on an audit appliance, the logged records and any credentials it stores — and depending on database configuration, SQLi on such devices frequently escalates toward command execution.

The DAR-7000 is aging enterprise networking hardware, and that shapes the threat: devices in this category are often out of vendor support with no forthcoming patch, yet remain in service at network chokepoints. Unauthenticated injection with a known endpoint is easily automated, and an audit gateway is an especially sensitive place to lose control of, since it sees the traffic and events it was deployed to record.

Our angle is exposure plus lifecycle. We check whether any DAR-7000 is reachable from untrusted networks and treat the likely absence of a patch as a planning assumption, which pushes the answer toward isolation or replacement rather than a fix. Where one must stay online, virtual patching at a fronting control to block the injection path is a stopgap, not a resolution, on hardware this old.