Cyber Resilience

CVE-2022-44928

CriticalPublic PoCRCE

Published: 02 December 2022

Published
02 December 2022
Modified
24 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1475 94.6th percentile
Risk Priority 28 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-44928 is a critical-severity OS Command Injection (CWE-78) vulnerability in D-Link Dvg-G5402Sp Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

D-Link DVG-G5402SP firmware version GE_1.03 contains a command injection vulnerability (CWE-78) in the Maintenance function. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the affected Maintenance endpoints and execute arbitrary operating-system commands on the device, resulting in complete takeover of the affected gateway.

Public proof-of-concept material has been published for this issue, and the current EPSS score of 0.1475 (peak 0.1519) indicates moderate and stable exploitation interest since disclosure. No vendor advisory or patch information is referenced in the available sources.

EU & UK References

Vulnerability details

D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

d-link
dvg-g5402sp firmware
ge_1.03

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References