Arbitrary Code Execution Vulnerability in D-Link DIR-825 Routers

CVE-2022-43646

Summary

This vulnerability affects D-Link DIR-825 routers, associated with the Vimeo plugin for the xupnpd service. It allows attackers on the same network to execute arbitrary code due to insufficient validation of input before system calls. Since authentication is not required for exploitation, an attacker can leverage this flaw to gain control under the context of the admin user, potentially compromising the entire device and its data.

References