PT-2022-5537 · D Link · D-Link Dir-1935

Published 2022-06-14 · Updated 2023-11-08 · CVE-2022-43623

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-1935 version 1.03

Description The issue is related to the handling of SetWebFilterSetting requests in the web management portal of D-Link DIR-1935 routers. Specifically, when parsing the WebFilterURLs element, the process does not properly validate a user-supplied string before using it to execute a system call. This can be exploited by network-adjacent attackers to execute arbitrary code on affected installations, even though authentication is required, as the existing authentication mechanism can be bypassed. An attacker can leverage this to execute code in the context of root.

Recommendations For D-Link DIR-1935 version 1.03, as a temporary workaround, consider disabling the SetWebFilterSetting function until a patch is available. Restrict access to the web management portal to minimize the risk of exploitation. Avoid using the WebFilterURLs element in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-06866

CVE-2022-43623

ZDI-22-1492

Affected Products

D-Link Dir-1935

References · 7

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06866 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43623 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1492 · Security Note
• https://vuldb.com/ru/?id.212989 · Note
• https://t.me/cibsecurity/61084 · Telegram Post