CVE-2022-43646

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.8HIGH

EPSS

2.6%

top 14.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-825\/ac Firmware Dlink Dir-825\/ee Firmware D-link Dir-825

Timeline

PublishedMar 29

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the cont…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDdlink/dir-825\/ac_firmware1.0.9

▶NVDdlink/dir-825\/ee_firmware1.0.9

▶CVEListV5d-link/dir-8251.0.9

Patches

Patch: supportannouncement.us.dlink.com ↗Patch: supportannouncement.us.dlink.com ↗

🔴Vulnerability Details

CVEList

CVE-2022-43646: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1↗2023-03-29

▶

GHSA

GHSA-wccm-69w3-xxcw: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1↗2023-03-29

▶