Lucene search

INCDCVELIST:CVE-2022-36786

HistoryNov 17, 2022 - 12:00 a.m.

CVE-2022-36786 DLINK - DSL-224 Post-auth RCE.

2022-11-1700:00:00

INCD

www.cve.org

dlink

router

vulnerability

rce

ntp

jsonrpc

api

injection

command

root

permissions

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

DLINK - DSL-224 Post-auth RCE.
DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API.
It is possible to inject a command through this interface that will run with ROOT permissions on the router.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "DSL-224",
    "vendor": "D-Link",
    "versions": [
      {
        "lessThan": "Update to version 3.0.9_Beta Hotfix",
        "status": "affected",
        "version": "All versions",
        "versionType": "custom"
      }
    ]
  }
]

References

www.gov.il/en/Departments/faq/cve_advisories

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

Related for CVELIST:CVE-2022-36786