CVE-2022-46552
published 2023-02-02CVE-2022-46552: D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This…
PriorityP269high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
10.50%
95.8th percentile
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-846_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command{"SetIpMacBindSettings":{"lan_unit":"0","lan(0)_dhcps_staticlist":"1,$(id>rce_confirmed),02:42:d6:f9:dc:4e,192.168.0.15"}}↗
- →A follow-up GET request to /HNAP1/rce_confirmed (or any attacker-chosen filename under /HNAP1/) is used to retrieve command output, confirming successful exploitation; monitor for unexpected GET requests to /HNAP1/<non-standard-resource>. ↗
- →The exploit runs as root on the device; a response body of 'uid=0(root) gid=0(root)' from the router's web server confirms full compromise. ↗
- ·The exploit targets a specific firmware version; other DIR-846 firmware versions may or may not be affected. ↗
- ·Exploitation requires a valid authenticated session (PHPSESSID, uid, PrivateKey cookies); the exploit assumes the attacker has already obtained or can brute-force valid session credentials. ↗
- ·The HNAP_AUTH header value is session- and timestamp-dependent, meaning replaying the exact captured request will not work without recomputing the HMAC for the current session. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.htmlhttps://cwe.mitre.org/data/definitions/78.htmlhttps://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6ehttps://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.phphttps://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.mdhttps://www.dlink.com/en/security-bulletin/https://www.php.net/manual/en/ref.exec.phphttp://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.htmlhttps://cwe.mitre.org/data/definitions/78.htmlhttps://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6ehttps://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.phphttps://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.mdhttps://www.dlink.com/en/security-bulletin/https://www.php.net/manual/en/ref.exec.php
2023-02-02
Published