CVE-2022-30521
Published: 02 June 2022
Summary
CVE-2022-30521 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-890L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 17.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a stack-based buffer overflow (CWE-787) in the LAN-side Web-Configuration Interface of D-Link DIR-890L Wi-Fi router firmware versions up to and including DIR890LA1_FW107b09.bin. The flaw resides in the function at offset 0x17958 within /htdocs/cgibin, which invokes sprintf on HTTP header parameters without length validation, allowing an attacker-controlled input to overflow the stack buffer.
An unauthenticated remote attacker can exploit the issue by sending a crafted payload to TCP port 49152, achieving arbitrary code execution on the device with no user interaction or credentials required. The CVSS 3.1 score of 9.8 reflects the combination of network attack vector, low complexity, and full impact on confidentiality, integrity, and availability.
Public references include D-Link’s security bulletin page along with proof-of-concept code and detailed write-ups hosted on GitHub that demonstrate the overflow and payload construction. No specific patch or firmware version is enumerated in the supplied references.
EPSS for the CVE rose from a low baseline to a peak of 0.0745 on 2025-12-11 before receding to the current value of 0.0176, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-52381
Vulnerability details
The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checking the length of strings in parameters given by…
more
HTTP header and can be controlled by users easily. The attackers can exploit the vulnerability to carry out arbitrary code by means of sending a specially constructed payload to port 49152.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.