CVE-2022-37123
Published: 31 August 2022
Summary
CVE-2022-37123 is a high-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-816 routers running firmware A2_v1.10CNB04.img contain an OS command injection vulnerability (CWE-78) in the /goform/form2userconfig.cgi endpoint. The flaw permits an attacker to supply crafted input that is passed directly to a system command interpreter, resulting in arbitrary command execution on the device. The issue carries a CVSS 3.1 score of 8.8 with network attack vector, low complexity, and low privileges required.
An authenticated attacker with network access to the management interface can exploit the endpoint to execute commands with the privileges of the web server process. Successful exploitation grants the ability to read or modify configuration files, alter routing behavior, or pivot to other devices on the local network, affecting confidentiality, integrity, and availability.
Public references include a detailed proof-of-concept on GitHub and D-Link’s security bulletin page; the latter should be consulted for any vendor-supplied firmware updates or configuration guidance. The EPSS score has remained flat at 0.1189 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39776
Vulnerability details
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.