CVE-2022-44832

Deeper analysis

D-Link DIR-3040 routers running firmware version 120B03 contain a command injection vulnerability in the SetTriggerLEDBlink function. The flaw is tracked as CVE-2022-44832, carries a CVSS 3.1 score of 9.8, and is classified under CWE-77. It allows unauthenticated network attackers to supply crafted input that is executed by the device without requiring user interaction or credentials.

An attacker with network access can send malicious requests directly to the affected function, resulting in arbitrary command execution on the router. Successful exploitation grants full control over the device, enabling actions such as configuration changes, traffic interception, or use of the router as a pivot point into the local network.

D-Link has published a security bulletin addressing the issue, although the provided references do not detail specific firmware updates or workarounds beyond directing users to the vendor advisory page. Public proof-of-concept material is available in a GitHub repository that reproduces the injection.

The CVE maintains an EPSS score of 0.25 with a recorded peak of 0.28, indicating moderate and relatively stable exploitation interest since disclosure.