PT-2022-23830 · D Link · D-Link Dir-816

Published 2022-08-22 · Updated 2023-08-08 · CVE-2022-37134

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-link DIR-816 version A2 v1.10CNB04.img

Description The issue arises from a Buffer Overflow vulnerability via the /goform/form2Wan.cgi endpoint. When wantype is 3, the l2tp usrname will be decrypted by base64, and the result will be stored in v94. This process does not check the size of l2tp usrname, resulting in a stack overflow.

Recommendations For D-link DIR-816 version A2 v1.10CNB04.img, as a temporary workaround, consider restricting access to the /goform/form2Wan.cgi endpoint until a patch is available. Additionally, avoid using the l2tp usrname variable in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2022-37134

Affected Products

D-Link Dir-816

References · 5

• 🔥 https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/form2Wan_cgi/readme.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37134 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37134 · Vendor Advisory
• https://t.me/cibsecurity/48503 · Telegram Post