CVE-2022-36755

CWE-287 — Improper AuthenticationCWE-863 — Incorrect Authorization3 documents3 sources
Severity
9.8CRITICAL
EPSS
1.0%
top 22.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Dlink Dir-845l Firmware
Timeline
PublishedAug 28
Latest updateAug 29

Description

D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDdlink/dir-845l_firmware1.0.0 — 1.0.3

Patches

Patch: drive.google.com ↗Patch: drive.google.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-m4pg-623x-3c8h: D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg↗2022-08-29
▶
CVEList
CVE-2022-36755: D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg↗2022-08-28
▶
CVE-2022-36755 (CRITICAL CVSS 9.8) | D-Link DIR845L A1 contains a authen | cvebase.io