PT-2022-19546 · D Link · D-Link Dap-1330

Published 2022-05-10 · Updated 2022-05-16 · CVE-2022-29329

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DAP-1330 OSS-firmware version 1.00b21

Description A heap overflow issue was discovered via the devicename parameter in the "/goform/setDeviceSettings" API endpoint.

Recommendations For D-Link DAP-1330 OSS-firmware version 1.00b21, as a temporary workaround, consider restricting access to the "/goform/setDeviceSettings" API endpoint to minimize the risk of exploitation. Avoid using the devicename parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-29329

Affected Products

D-Link Dap-1330

References · 5

• 🔥❌ https://github.com/EPhaha/IOT_vuln/tree/main/d-link/dap-1330/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-29329 · Vendor Advisory
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29329 · Security Note
• https://t.me/cibsecurity/42250 · Telegram Post