Sign-up

ID

VAR-202209-1297


CVE

CVE-2022-40717


TITLE

D-Link DIR-2150  Out-of-Bounds Write Vulnerability in Router

Trust: 0.8

sources: JVNDB: JVNDB-2022-011820

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15727. D-Link DIR-2150 Routers contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-2150 is a wireless router device of D-Link company

Trust: 2.88

sources: NVD: CVE-2022-40717 // JVNDB: JVNDB-2022-011820 // ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // VULMON: CVE-2022-40717

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-21662

AFFECTED PRODUCTS

vendor:dlinkmodel:dir-2150scope:lteversion:4.0.1

Trust: 1.0

vendor:d linkmodel:dir-2150scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dir-2150scope:eqversion:dir-2150 firmware 4.0.1

Trust: 0.8

vendor:d linkmodel:dir-2150scope: - version: -

Trust: 0.7

vendor:d linkmodel:dir-2150scope:eqversion:4.0.1

Trust: 0.6

sources: ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // JVNDB: JVNDB-2022-011820 // NVD: CVE-2022-40717

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-40717
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-40717
value: HIGH

Trust: 1.0

NVD: CVE-2022-40717
value: HIGH

Trust: 0.8

ZDI: CVE-2022-40717
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-21662
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202301-1877
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-21662
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-40717
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-40717
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2022-40717
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // JVNDB: JVNDB-2022-011820 // CNNVD: CNNVD-202301-1877 // NVD: CVE-2022-40717 // NVD: CVE-2022-40717

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-011820 // NVD: CVE-2022-40717

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1877

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202301-1877

PATCH

title:Multiple Vulnerabiltiiesurl:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304

Trust: 1.5

title:Patch for D-Link DIR-2150 Buffer Overflow Vulnerability (CNVD-2023-21662)url:https://www.cnvd.org.cn/patchInfo/show/416251

Trust: 0.6

title:D-Link DIR-2150 Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=223871

Trust: 0.6

sources: ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // JVNDB: JVNDB-2022-011820 // CNNVD: CNNVD-202301-1877

EXTERNAL IDS

db:NVDid:CVE-2022-40717

Trust: 4.6

db:ZDIid:ZDI-22-1220

Trust: 3.8

db:DLINKid:SAP10304

Trust: 1.7

db:JVNDBid:JVNDB-2022-011820

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15727

Trust: 0.7

db:CNVDid:CNVD-2023-21662

Trust: 0.6

db:CNNVDid:CNNVD-202301-1877

Trust: 0.6

db:VULMONid:CVE-2022-40717

Trust: 0.1

sources: ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // VULMON: CVE-2022-40717 // JVNDB: JVNDB-2022-011820 // CNNVD: CNNVD-202301-1877 // NVD: CVE-2022-40717

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-1220/

Trust: 3.1

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10304

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-40717

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-40717/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1220 // CNVD: CNVD-2023-21662 // VULMON: CVE-2022-40717 // JVNDB: JVNDB-2022-011820 // CNNVD: CNNVD-202301-1877 // NVD: CVE-2022-40717

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-22-1220

SOURCES

db:ZDIid:ZDI-22-1220
db:CNVDid:CNVD-2023-21662
db:VULMONid:CVE-2022-40717
db:JVNDBid:JVNDB-2022-011820
db:CNNVDid:CNNVD-202301-1877
db:NVDid:CVE-2022-40717

LAST UPDATE DATE

2024-08-14T14:02:22.049000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1220date:2022-09-14T00:00:00
db:CNVDid:CNVD-2023-21662date:2023-03-29T00:00:00
db:VULMONid:CVE-2022-40717date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-011820date:2023-08-24T03:05:00
db:CNNVDid:CNNVD-202301-1877date:2023-02-06T00:00:00
db:NVDid:CVE-2022-40717date:2023-02-03T19:44:30.477

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1220date:2022-09-14T00:00:00
db:CNVDid:CNVD-2023-21662date:2023-03-29T00:00:00
db:VULMONid:CVE-2022-40717date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-011820date:2023-08-24T00:00:00
db:CNNVDid:CNNVD-202301-1877date:2023-01-26T00:00:00
db:NVDid:CVE-2022-40717date:2023-01-26T18:59:53.297