Cyber Resilience

CVE-2022-43109

CriticalPublic PoCRCE

Published: 03 November 2022

Published
03 November 2022
Modified
05 May 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0796 92.3th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-43109 is a critical-severity Command Injection (CWE-77) vulnerability in Dlink Dir-823G Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

D-Link DIR-823G firmware version 1.0.2 contains a command injection vulnerability (CWE-77) in the SetNetworkTomographySettings function. The flaw permits unauthenticated remote attackers to supply a crafted network packet that results in arbitrary command execution on the device, reflected in the CVSS 3.1 score of 9.8 with an attack vector of network, low complexity, and no required privileges or user interaction.

An attacker with network access to an affected device can exploit the issue to execute operating-system commands, potentially leading to full control over the router including the ability to read, modify, or delete data and disrupt device operation.

D-Link has published a security bulletin addressing the vulnerability, available on its official security page, though the bulletin does not detail specific patch versions or workarounds in the provided references. The associated EPSS score has remained flat at 0.0796 with no material increase since disclosure.

EU & UK References

Vulnerability details

D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via a crafted packet.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

dlink
dir-823g firmware
1.0.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References