CVE-2022-43109
Published: 03 November 2022
Summary
CVE-2022-43109 is a critical-severity Command Injection (CWE-77) vulnerability in Dlink Dir-823G Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-823G firmware version 1.0.2 contains a command injection vulnerability (CWE-77) in the SetNetworkTomographySettings function. The flaw permits unauthenticated remote attackers to supply a crafted network packet that results in arbitrary command execution on the device, reflected in the CVSS 3.1 score of 9.8 with an attack vector of network, low complexity, and no required privileges or user interaction.
An attacker with network access to an affected device can exploit the issue to execute operating-system commands, potentially leading to full control over the router including the ability to read, modify, or delete data and disrupt device operation.
D-Link has published a security bulletin addressing the vulnerability, available on its official security page, though the bulletin does not detail specific patch versions or workarounds in the provided references. The associated EPSS score has remained flat at 0.0796 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-46158
Vulnerability details
D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via a crafted packet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.