CVE-2022-46476
Published: 19 January 2023
Summary
CVE-2022-46476 is a critical-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-859 A1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-859 A1 firmware version 1.05 contains an OS command injection vulnerability (CWE-78) in the soapcgi_main function, where the service= parameter is passed to the system shell without sanitization. The flaw affects the router's SOAP CGI endpoint and carries a CVSS 3.1 score of 9.8, reflecting network-accessible, unauthenticated exploitation with full confidentiality, integrity, and availability impact.
An unauthenticated attacker can send a crafted HTTP request containing shell metacharacters in the service variable to achieve arbitrary command execution on the device. Successful exploitation grants complete control of the router, enabling traffic interception, persistence, or use as an entry point into the attached network.
The EPSS score rose from low values after disclosure to a peak of 0.5680 on 2025-12-11 before receding to the current 0.3427, indicating measurable post-publication exploitation interest. Public references consist of technical write-ups and proof-of-concept material hosted on GitHub that reproduce the injection but contain no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49280
Vulnerability details
D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.