CVE-2022-41140
Published: 26 January 2023
Summary
CVE-2022-41140 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-882-Us Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-41140 is a stack-based buffer overflow vulnerability in the lighttpd service on multiple D-Link routers. The flaw stems from insufficient validation of the length of user-supplied data before it is copied into a fixed-length buffer, and it is reachable on the default TCP port 80 listener. Successful exploitation grants arbitrary code execution in the root context. The issue was originally reported as ZDI-CAN-13796 and carries a CVSS 3.1 score of 8.8.
Network-adjacent attackers can exploit the vulnerability without authentication or user interaction. By sending a crafted request to the web service, an attacker can overwrite the stack and achieve remote code execution with full system privileges on the affected router.
D-Link has published security advisory SAP10291 that addresses the affected router models and provides updated firmware. The Zero Day Initiative advisory ZDI-22-1290 likewise recommends applying the vendor-supplied patches. The EPSS score has remained flat at 0.0573 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44381
Vulnerability details
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default.…
more
The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13796.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.