CVE-2022-40799

published 2022-11-29

CVE-2022-40799: Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

Priority P1 86 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

KEV ITW EXPLOIT

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dlink	dnr-322l_firmware	<= 2.60b15	—

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability class is 'Data Integrity Failure in Backup Config' — monitor for authenticated requests to the Backup Config functionality on D-Link DNR-322L devices that may deliver or trigger execution of unauthenticated/unverified code/commands ↗
• → Classify as 'Download of Code Without Integrity Check' — look for network traffic from the device fetching and executing externally-hosted code/configs without integrity validation, particularly following a Backup Config operation ↗

• · Exploitation requires authentication — prioritize monitoring for authenticated sessions interacting with the Backup Config feature, and audit all accounts with access to the device management interface ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vulncheck 8.8 HIGH

cisa 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-494