Lucene search
PRIOn knowledge basePRION:CVE-2022-40720HistoryJan 26, 2023 - 6:59 p.m.
Design/Logic Flaw
2023-01-2618:59:00
PRIOn knowledge base
www.prio-n.com
3
network-adjacent attack
arbitrary commands
d-link dir-2150
dreambox plugin
xupnpd service
tcp port 4044
system call
code execution
zdi-can-15935
nvd
0.001 Low
EPSS
Percentile
39.6%
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Dreambox plugin for the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the router. Was ZDI-CAN-15935.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dir-2150_firmware | le | 4.0.1 |
Related
cvelist
cvelist
CVE-2022-40720
2023-01-26 00:00:00
cve
cve
CVE-2022-40720
2023-01-26 18:59:53
nvd
nvd
CVE-2022-40720
2023-01-26 18:59:53
cnvd
cnvd
D-Link DIR-2150 Operating System Command Injection Vulnerability
2022-09-19 00:00:00
zdi
zdi
openvas
openvas
D-Link DIR-2150 <= 4.0.1 Multiple Vulnerabilities
2023-02-28 00:00:00