CVE-2022-37134 — Improper Validation of Specified Quantity in Input in Dlink Dir-816 Firmware

CWE-1284 — Improper Validation of Specified Quantity in InputCWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
1.9%
top 16.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Dlink Dir-816 Firmware
Timeline
PublishedAug 22
Latest updateAug 23

Description

D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and the result will be stored in v94, which does not check the size of l2tp_usrname, resulting in stack overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDdlink/dir-816_firmware1.10cnb04

🔴Vulnerability Details

2
GHSA
GHSA-fxcp-h947-pw6p: D-link DIR-816 A2_v1↗2022-08-23
▶
CVEList
CVE-2022-37134: D-link DIR-816 A2_v1↗2022-08-22
▶
CVE-2022-37134 — Dlink Dir-816 Firmware vulnerability | cvebase