Lucene search

[email protected]CVE-2022-38873

HistoryDec 20, 2022 - 8:15 p.m.

CVE-2022-38873

2022-12-2020:15:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

d-link

dap-2310

dap-2330

dap-2360

dap-2553

dap-2660

dap-2690

dap-2695

dap-3320

dap-3662

cve-2022-38873

dos

firmware vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

49.7%

JSON

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

CPENameOperatorVersion
dlink:dap-2310_firmwaredlink dap-2310 firmwarele2.10rc036
dlink:dap-2330_firmwaredlink dap-2330 firmwarele1.06rc020
dlink:dap-2360_firmwaredlink dap-2360 firmwarele2.10rc050
dlink:dap-2553_firmwaredlink dap-2553 firmwarele3.10rc031
dlink:dap-2660_firmwaredlink dap-2660 firmwarele1.15rc093
dlink:dap-2690_firmwaredlink dap-2690 firmwarele3.20rc106
dlink:dap-2695_firmwaredlink dap-2695 firmwarelt1.20rc119
dlink:dap-3320_firmwaredlink dap-3320 firmwarelt1.05rc027
dlink:dap-3662_firmwaredlink dap-3662 firmwarele1.05rc047

CPE	Name	Operator	Version
dlink:dap-2310_firmware	dlink dap-2310 firmware	le	2.10rc036
dlink:dap-2330_firmware	dlink dap-2330 firmware	le	1.06rc020
dlink:dap-2360_firmware	dlink dap-2360 firmware	le	2.10rc050
dlink:dap-2553_firmware	dlink dap-2553 firmware	le	3.10rc031
dlink:dap-2660_firmware	dlink dap-2660 firmware	le	1.15rc093
dlink:dap-2690_firmware	dlink dap-2690 firmware	le	3.20rc106
dlink:dap-2695_firmware	dlink dap-2695 firmware	lt	1.20rc119
dlink:dap-3320_firmware	dlink dap-3320 firmware	lt	1.05rc027
dlink:dap-3662_firmware	dlink dap-3662 firmware	le	1.05rc047

References

github.com/Yuhao-W/BUG--D-Link--Firmware-Update-Vulnerabilities/blob/main/README.md

www.dlink.com/en/security-bulletin/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

49.7%

JSON

Related for CVE-2022-38873

cvelist1 prion1