CVE-2022-46642
Published: 23 December 2022
Summary
CVE-2022-46642 is a critical-severity Command Injection (CWE-77) vulnerability in Dlink Dir-846 Firmware. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-846 firmware version A1_FW100A43 contains a command injection vulnerability in the SetAutoUpgradeInfo function, where the auto_upgrade_hour parameter is processed without adequate input validation. The flaw is tracked as CVE-2022-46642 and is associated with CWE-77, carrying a CVSS 3.1 score of 9.9 that reflects network attack vector, low complexity, and low-privileged access requirements.
An authenticated attacker with network connectivity to the device can supply a crafted auto_upgrade_hour value to execute arbitrary operating-system commands. Successful exploitation grants the attacker the ability to compromise confidentiality, integrity, and availability on the affected router, with the impact crossing security boundaries due to the device's role in the network.
D-Link references the issue in its published security bulletin, which is available on the vendor's security advisory page. The EPSS score has remained flat at 0.0693 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49446
Vulnerability details
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.