CVE-2022-28896
Published: 10 May 2022
Summary
CVE-2022-28896 is a critical-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-882 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A command injection vulnerability tracked as CVE-2022-28896 affects the /setnetworksettings/SubnetMask component in D-Link DIR882 routers running firmware DIR882A1_FW130B06. The flaw, assigned CWE-78, permits unauthenticated remote attackers to inject operating system commands through a crafted SubnetMask parameter and is rated 9.8 on CVSS 3.1.
An attacker with network access to the device can send a malicious HTTP request to the affected endpoint, resulting in arbitrary command execution with root privileges and full control over the router.
D-Link has published a security bulletin addressing the issue, while public proof-of-concept code demonstrating the injection is available on GitHub. The EPSS score reached a peak of 0.3342 and currently stands at 0.2861.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33331
Vulnerability details
A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.