Command Injection Vulnerability in D-Link DIR-816 Wireless Router
CVE-2022-37129

8.8HIGH

Key Information:

Vendor

D-Link
Status
Dir-816 Firmware
Vendor
CVE Published:
31 August 2022

What is CVE-2022-37129?

The D-Link DIR-816 A2_v1.10CNB04.img is susceptible to a command injection vulnerability through the /goform/SystemCommand endpoint. By injecting commands via the command parameter, an attacker can manipulate the execution flow of the router's firmware, ultimately leading to arbitrary command execution on the device. This flaw poses significant security risks, allowing unauthorized control and compromising the integrity of the network.

References

https://www.dlink.com/en/security-bulletin/
x_refsource_MISC
https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/S...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-37129 : Command Injection Vulnerability in D-Link DIR-816 Wireless Router