CVE-2022-46552

Deeper analysis

D-Link DIR-846 routers running firmware version FW100A53DBR contain an OS command injection vulnerability, tracked as CVE-2022-46552 and assigned CWE-78. The flaw resides in the lan(0)_dhcps_staticlist parameter and is reachable through an authenticated HTTP POST request, allowing arbitrary command execution on the device.

An attacker with valid administrative credentials on the web interface can submit a crafted POST request containing shell metacharacters in the affected parameter. Successful exploitation grants remote command execution with the privileges of the web server process, enabling full control over the router’s configuration, traffic inspection, or further lateral movement within the local network. The CVSS 3.1 score of 8.8 reflects network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

EPSS for this CVE rose from a low baseline to a peak of 0.4342 on 2025-01-22 before receding to the current value of 0.1868, indicating a period of increased exploitation interest well after the original disclosure. Public references include exploit code and technical write-ups but no vendor advisory or firmware patch details.