CVE-2022-42160
Published: 13 October 2022
Summary
CVE-2022-42160 is a high-severity Command Injection (CWE-77) vulnerability in Dlink Covr 1203 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link COVR 1200, 1202, and 1203 routers running firmware version 1.08 contain a command injection vulnerability tracked as CVE-2022-42160. The flaw, assigned CWE-77, resides in the SetNTPServerSettings function and is triggered through the system_time_timezone parameter, allowing improper neutralization of special elements in commands.
An attacker with network access and valid low-privileged credentials can supply a malicious timezone value to execute arbitrary operating-system commands on the device. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that successful exploitation can result in full compromise of confidentiality, integrity, and availability without user interaction.
Public references point to a D-Link security bulletin page and a detailed disclosure PDF hosted on GitHub, though no specific patch or mitigation steps are enumerated in the available references. The associated EPSS score has remained flat at 0.0924 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45237
Vulnerability details
D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the system_time_timezone parameter at function SetNTPServerSettings.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.