PT-2022-19827 · D Link · D-Link Dir-890L

Tyeyeah · Published 2022-06-03 · Updated 2024-10-28 · CVE-2022-29778

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-890L version 1.20b01

Description The issue allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter descriptor at the API endpoint "SetVirtualServerSettings.php".

Recommendations For D-Link DIR-890L version 1.20b01, consider disabling the Wake-On-Lan option as a temporary workaround until a patch is available. Restrict access to the SetVirtualServerSettings.php endpoint to minimize the risk of exploitation. Avoid using the parameter descriptor in the affected API endpoint until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-29778

Affected Products

D-Link Dir-890L

References · 9

• 🔥 https://github.com/TyeYeah/DIR-890L-1.20-RCE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29778 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29778 · Vendor Advisory
• https://t.me/cvenotify/88718 · Telegram Post
• https://t.me/cvenotify/31124 · Telegram Post
• https://t.me/cibsecurity/43834 · Telegram Post
• https://t.me/cvenotify/86570 · Telegram Post
• https://t.me/cvenotify/80154 · Telegram Post