PT-2022-4735 · D Link · D-Link Dsl-3782

Published 2022-06-26 · Updated 2023-08-08 · CVE-2022-34527

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 versions 1.03 and below

Description The issue is related to a command injection vulnerability via the byte 4C0160 function. It is associated with insufficient argument validation for certain CLI commands, which can be exploited to elevate privileges and execute arbitrary commands.

Recommendations For D-Link DSL-3782 versions 1.03 and below, consider disabling the byte 4C0160 function as a temporary workaround until a patch is available. Restrict access to CLI commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2022-05630

CVE-2022-34527

Affected Products

D-Link Dsl-3782

References · 6

• 🔥 https://github.com/1160300418/Vuls/blob/main/D-Link/DSL-3782/CMDi_in_D-Link%20DSL-3782.md · Exploit
• https://bdu.fstec.ru/vul/2022-05630 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34527 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34527 · Vendor Advisory
• https://vuldb.com/ru/?id.205325 · Note