Lucene search

K
prionPRIOn knowledge basePRION:CVE-2022-40719
HistoryJan 26, 2023 - 6:59 p.m.

Design/Logic Flaw

2023-01-2618:59:00
PRIOn knowledge base
www.prio-n.com
6
network-adjacent attackers
arbitrary commands
d-link dir-2150
xupnpd service

EPSS

0.001

Percentile

39.6%

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15906.

EPSS

0.001

Percentile

39.6%

Related for PRION:CVE-2022-40719