CVE-2022-37129

Deeper analysis

CVE-2022-37129 is an OS command injection vulnerability (CWE-78) affecting the D-Link DIR-816 wireless router running firmware A2_v1.10CNB04.img. Untrusted input supplied to the command parameter at the /goform/SystemCommand endpoint is concatenated via snprintf into a buffer at byte_4836B0, which is subsequently passed directly to doSystem without sanitization or escaping.

An authenticated attacker with network access can supply arbitrary shell commands through this endpoint. Successful exploitation grants the ability to execute operating-system commands with the privileges of the web server process, resulting in full control over device configuration, traffic inspection, or persistence mechanisms. The vulnerability carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low complexity, and low required privileges.

D-Link has published a security bulletin addressing the affected DIR-816 firmware; administrators should consult the vendor advisory for available patches or mitigation steps. The associated EPSS score has remained flat at 0.1530 since disclosure, indicating moderate but stable exploitation interest.