Arbitrary Code Execution Vulnerability in D-Link DIR-2150 Routers
CVE-2022-40717
8.8HIGH
Summary
A security flaw in D-Link DIR-2150 4.0.1 routers exposes them to arbitrary code execution by allowing network-adjacent attackers to supply malicious input. The vulnerability stems from improper validation of user-supplied data length in the anweb service, which operates on TCP ports 80 and 443. This oversight permits attackers to execute code as root without requiring any authentication. The vulnerability highlights the importance of secure coding practices and timely software updates.
Affected Version(s)
DIR-2150 4.0.1
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
CVSS V3.0
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Anonymous