PT-2022-6264 · D Link · D-Link Dir-846

Françoa Taffarel Rosário Corrêa + 2 · Published 2022-11-30 · Updated 2023-04-06 · CVE-2022-46552

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-846 Firmware FW100A53DBR

Description The issue is related to a remote command execution vulnerability via the lan(0) dhcps staticlist parameter. This vulnerability can be exploited through a crafted POST request, allowing a remote attacker to execute arbitrary commands. The vulnerability is due to the lack of proper sanitization of special elements used in the operating system command when processing the lan(0) dhcps staticlist parameter.

Recommendations For D-Link DIR-846 Firmware FW100A53DBR, as a temporary workaround, consider disabling the lan(0) dhcps staticlist parameter until a patch is available. Restrict access to the vulnerable parameter to minimize the risk of exploitation. Avoid using the lan(0) dhcps staticlist parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00679

CVE-2022-46552

Affected Products

D-Link Dir-846

References · 13

• 🔥 https://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.md · Exploit
• 🔥 https://exploit-db.com/exploits/51243 · Exploit
• 🔥 https://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6e · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-46552 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46552 · Vendor Advisory
• https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php · Note
• http://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.html · Note
• https://php.net/manual/en/ref.exec.php · Note
• https://t.me/cybersecuritytechnologies/8068 · Telegram Post
• https://cwe.mitre.org/data/definitions/78.html · Note
• https://t.me/cibsecurity/57394 · Telegram Post