7.8

CVE-2022-1262

Exploit
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dir-1360 Firmware Version 1.02b03
   Dlink ≫ Dir-1360 Version a1
Dlink ≫ Dir-1360 Firmware Version 1.03b02
   Dlink ≫ Dir-1360 Version a1
Dlink ≫ Dir-1360 Firmware Version 1.11b04
   Dlink ≫ Dir-1360 Version a1
Dlink ≫ Dir-1760 Firmware Version 1.01b04
   Dlink ≫ Dir-1760 Version -
Dlink ≫ Dir-1760 Firmware Version 1.11b03 Update beta
   Dlink ≫ Dir-1760 Version -
Dlink ≫ Dir-1960 Firmware Version 1.02b01
   Dlink ≫ Dir-1960 Version a1
Dlink ≫ Dir-1960 Firmware Version 1.03b03
   Dlink ≫ Dir-1960 Version a1
Dlink ≫ Dir-1960 Firmware Version 1.11b03
   Dlink ≫ Dir-1960 Version a1
Dlink ≫ Dir-2640 Firmware Version 1.11b02 Update beta
   Dlink ≫ Dir-2640 Version -
Dlink ≫ Dir-2660 Firmware Version 1.04b03
   Dlink ≫ Dir-2660 Version a1
Dlink ≫ Dir-2660 Firmware Version 1.11b04
   Dlink ≫ Dir-2660 Version a1
Dlink ≫ Dir-3040 Firmware Version 1.13b03 Update beta
   Dlink ≫ Dir-3040 Version -
Dlink ≫ Dir-3060 Firmware Version 1.00b12
   Dlink ≫ Dir-3060 Version -
Dlink ≫ Dir-3060 Firmware Version 1.11b04 Update beta
   Dlink ≫ Dir-3060 Version -
Dlink ≫ Dir-867 Firmware Version 1.20b10
   Dlink ≫ Dir-867 Version a1
Dlink ≫ Dir-878 Firmware Version 1.20b05
   Dlink ≫ Dir-878 Version -
Dlink ≫ Dir-878 Firmware Version 1.30b08
   Dlink ≫ Dir-878 Version -
Dlink ≫ Dir-882 Firmware Version 1.20b06
   Dlink ≫ Dir-882 Version -
Dlink ≫ Dir-1360 Firmware Version 1.00b15
   Dlink ≫ Dir-1360 Version -
Dlink ≫ Dir-1360 Firmware Version 1.01b03
   Dlink ≫ Dir-1360 Version -
Dlink ≫ Dir-1360 Firmware Version 1.11b04 Update beta
   Dlink ≫ Dir-1360 Version -
Dlink ≫ Dir-1960 Firmware Version 1.11b03 Update beta
   Dlink ≫ Dir-1960 Version -
Dlink ≫ Dir-2640 Firmware Version 1.01b04
   Dlink ≫ Dir-2640 Version a1
Dlink ≫ Dir-2640 Firmware Version 1.11b02
   Dlink ≫ Dir-2640 Version a1
Dlink ≫ Dir-2660 Firmware Version 1.00b14
   Dlink ≫ Dir-2660 Version -
Dlink ≫ Dir-2660 Firmware Version 1.01b03
   Dlink ≫ Dir-2660 Version -
Dlink ≫ Dir-2660 Firmware Version 1.02b01
   Dlink ≫ Dir-2660 Version -
Dlink ≫ Dir-2660 Firmware Version 1.03b04
   Dlink ≫ Dir-2660 Version -
Dlink ≫ Dir-2660 Firmware Version 1.11b04 Update beta
   Dlink ≫ Dir-2660 Version -
Dlink ≫ Dir-3040 Firmware Version 1.11b02
   Dlink ≫ Dir-3040 Version a1
Dlink ≫ Dir-3040 Firmware Version 1.12b01
   Dlink ≫ Dir-3040 Version a1
Dlink ≫ Dir-3040 Firmware Version 1.13b03
   Dlink ≫ Dir-3040 Version a1
Dlink ≫ Dir-3040 Firmware Version 1.20b03
   Dlink ≫ Dir-3040 Version a1
Dlink ≫ Dir-3060 Firmware Version 1.01b07
   Dlink ≫ Dir-3060 Version a1
Dlink ≫ Dir-3060 Firmware Version 1.02b03
   Dlink ≫ Dir-3060 Version a1
Dlink ≫ Dir-3060 Firmware Version 1.11b02
   Dlink ≫ Dir-3060 Version a1
Dlink ≫ Dir-3060 Firmware Version 1.11b04
   Dlink ≫ Dir-3060 Version a1
Dlink ≫ Dir-867 Firmware Version 1.10b04
   Dlink ≫ Dir-867 Version -
Dlink ≫ Dir-867 Firmware Version 1.30b07
   Dlink ≫ Dir-867 Version -
Dlink ≫ Dir-882 Firmware Version 1.30b06
   Dlink ≫ Dir-882 Version a1
Dlink ≫ Dir-882 Firmware Version 1.30b10
   Dlink ≫ Dir-882 Version a1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.23% 0.805
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.tenable.com/security/research/tra-2022-09
Third Party Advisory
Exploit