PT-2022-19548 · D Link · D-Link Dir-825 Ac1200 R2

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-29332

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-LINK DIR-825 AC1200 R2

Description The issue allows an attacker to perform a Directory Traversal attack by using the "../../../../" setting of the FTP server folder. This setting enables the attacker to set the router's root folder for FTP access, thereby allowing access to the entire router file system via the FTP server.

Recommendations For D-LINK DIR-825 AC1200 R2, consider disabling the FTP server until a patch is available to prevent exploitation of the Directory Traversal issue. Restrict access to the FTP server folder to minimize the risk of unauthorized file system access.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-29332

Affected Products

D-Link Dir-825 Ac1200 R2

References · 4

• 🔥 https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/d-link_dir-825_R2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29332 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29332 · Vendor Advisory
• https://t.me/cibsecurity/42824 · Telegram Post