CVE-2022-37130
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 26.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 26.33% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- dlink/dir-816 firmware
- Source
- cve@mitre.org
References
- https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20A2_v1.10CNB05/Diagnosis
- https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/Diagnosis/readme.mdExploit, Third Party Advisory
- https://www.dlink.com/en/security-bulletin/Vendor Advisory
- https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20A2_v1.10CNB05/Diagnosis
- https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/Diagnosis/readme.mdExploit, Third Party Advisory
- https://www.dlink.com/en/security-bulletin/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.