Sign-up

ID

VAR-202209-1282


CVE

CVE-2022-40719


TITLE

D-Link DIR-2150  In the router  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-007697

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15906. D-Link DIR-2150 The router has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-2150 is a wireless router device of D-Link company

Trust: 2.88

sources: NVD: CVE-2022-40719 // JVNDB: JVNDB-2022-007697 // ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // VULMON: CVE-2022-40719

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-21660

AFFECTED PRODUCTS

vendor:dlinkmodel:dir-2150scope:lteversion:4.0.1

Trust: 1.0

vendor:d linkmodel:dir-2150scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dir-2150scope:eqversion:dir-2150 firmware 4.0.1

Trust: 0.8

vendor:d linkmodel:dir-2150scope: - version: -

Trust: 0.7

vendor:d linkmodel:dir-2150scope:eqversion:4.0.1

Trust: 0.6

sources: ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // JVNDB: JVNDB-2022-007697 // NVD: CVE-2022-40719

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-40719
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-40719
value: HIGH

Trust: 1.0

NVD: CVE-2022-40719
value: HIGH

Trust: 0.8

ZDI: CVE-2022-40719
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-21660
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202301-1878
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-21660
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-40719
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-40719
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2022-40719
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // JVNDB: JVNDB-2022-007697 // CNNVD: CNNVD-202301-1878 // NVD: CVE-2022-40719 // NVD: CVE-2022-40719

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-007697 // NVD: CVE-2022-40719

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1878

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202301-1878

PATCH

title:Multiple Vulnerabiltiiesurl:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304

Trust: 1.5

title:Patch for D-Link DIR-2150 Operating System Command Injection Vulnerability (CNVD-2023-21660)url:https://www.cnvd.org.cn/patchInfo/show/416246

Trust: 0.6

title:D-Link DIR-2150 Fixes for operating system command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=223707

Trust: 0.6

sources: ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // JVNDB: JVNDB-2022-007697 // CNNVD: CNNVD-202301-1878

EXTERNAL IDS

db:NVDid:CVE-2022-40719

Trust: 4.6

db:ZDIid:ZDI-22-1223

Trust: 3.8

db:DLINKid:SAP10304

Trust: 1.7

db:JVNDBid:JVNDB-2022-007697

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15906

Trust: 0.7

db:CNVDid:CNVD-2023-21660

Trust: 0.6

db:CNNVDid:CNNVD-202301-1878

Trust: 0.6

db:VULMONid:CVE-2022-40719

Trust: 0.1

sources: ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // VULMON: CVE-2022-40719 // JVNDB: JVNDB-2022-007697 // CNNVD: CNNVD-202301-1878 // NVD: CVE-2022-40719

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-1223/

Trust: 3.1

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10304

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-40719

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-40719/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1223 // CNVD: CNVD-2023-21660 // VULMON: CVE-2022-40719 // JVNDB: JVNDB-2022-007697 // CNNVD: CNNVD-202301-1878 // NVD: CVE-2022-40719

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-22-1223

SOURCES

db:ZDIid:ZDI-22-1223
db:CNVDid:CNVD-2023-21660
db:VULMONid:CVE-2022-40719
db:JVNDBid:JVNDB-2022-007697
db:CNNVDid:CNNVD-202301-1878
db:NVDid:CVE-2022-40719

LAST UPDATE DATE

2024-08-14T14:02:21.975000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1223date:2022-09-14T00:00:00
db:CNVDid:CNVD-2023-21660date:2023-03-29T00:00:00
db:VULMONid:CVE-2022-40719date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-007697date:2023-07-20T00:27:00
db:CNNVDid:CNNVD-202301-1878date:2023-02-03T00:00:00
db:NVDid:CVE-2022-40719date:2023-02-02T15:17:50.130

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1223date:2022-09-14T00:00:00
db:CNVDid:CNVD-2023-21660date:2023-03-29T00:00:00
db:VULMONid:CVE-2022-40719date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-007697date:2023-07-20T00:00:00
db:CNNVDid:CNNVD-202301-1878date:2023-01-26T00:00:00
db:NVDid:CVE-2022-40719date:2023-01-26T18:59:53.540