Sign-up

ID

VAR-202209-1493


CVE

CVE-2022-41140


TITLE

plural  D-Link  Out-of-Bounds Write Vulnerability in Router

Trust: 0.8

sources: JVNDB: JVNDB-2022-007265

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13796. plural D-Link Routers contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-41140 // JVNDB: JVNDB-2022-007265 // ZDI: ZDI-22-1290 // VULMON: CVE-2022-41140

AFFECTED PRODUCTS

vendor:dlinkmodel:dir-882-usscope:lteversion:1.30b07

Trust: 1.0

vendor:dlinkmodel:dir-867scope:lteversion:1.30b08

Trust: 1.0

vendor:dlinkmodel:dir-878scope:lteversion:1.30b06

Trust: 1.0

vendor:d linkmodel:dir-878scope: - version: -

Trust: 0.8

vendor:d linkmodel:dir-882-usscope: - version: -

Trust: 0.8

vendor:d linkmodel:dir-867scope: - version: -

Trust: 0.8

vendor:d linkmodel:multiple routersscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-1290 // JVNDB: JVNDB-2022-007265 // NVD: CVE-2022-41140

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-41140
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-41140
value: HIGH

Trust: 1.0

NVD: CVE-2022-41140
value: HIGH

Trust: 0.8

ZDI: CVE-2022-41140
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202301-1873
value: HIGH

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-41140
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-41140
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2022-41140
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1290 // JVNDB: JVNDB-2022-007265 // CNNVD: CNNVD-202301-1873 // NVD: CVE-2022-41140 // NVD: CVE-2022-41140

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-007265 // NVD: CVE-2022-41140

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1873

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202301-1873

PATCH

title: - url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10291

Trust: 1.5

title:D-Link Fixes for Multiple Router Buffer Error Vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=223704

Trust: 0.6

sources: ZDI: ZDI-22-1290 // JVNDB: JVNDB-2022-007265 // CNNVD: CNNVD-202301-1873

EXTERNAL IDS

db:NVDid:CVE-2022-41140

Trust: 4.0

db:ZDIid:ZDI-22-1290

Trust: 3.2

db:DLINKid:SAP10291

Trust: 1.7

db:JVNDBid:JVNDB-2022-007265

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-13796

Trust: 0.7

db:CNNVDid:CNNVD-202301-1873

Trust: 0.6

db:VULMONid:CVE-2022-41140

Trust: 0.1

sources: ZDI: ZDI-22-1290 // VULMON: CVE-2022-41140 // JVNDB: JVNDB-2022-007265 // CNNVD: CNNVD-202301-1873 // NVD: CVE-2022-41140

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-1290/

Trust: 2.5

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10291

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-41140

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-41140/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1290 // VULMON: CVE-2022-41140 // JVNDB: JVNDB-2022-007265 // CNNVD: CNNVD-202301-1873 // NVD: CVE-2022-41140

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-22-1290

SOURCES

db:ZDIid:ZDI-22-1290
db:VULMONid:CVE-2022-41140
db:JVNDBid:JVNDB-2022-007265
db:CNNVDid:CNNVD-202301-1873
db:NVDid:CVE-2022-41140

LAST UPDATE DATE

2024-08-14T14:17:42.270000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1290date:2022-09-20T00:00:00
db:VULMONid:CVE-2022-41140date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-007265date:2023-07-13T07:52:00
db:CNNVDid:CNNVD-202301-1873date:2023-02-03T00:00:00
db:NVDid:CVE-2022-41140date:2023-02-02T15:18:20.907

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1290date:2022-09-20T00:00:00
db:VULMONid:CVE-2022-41140date:2023-01-26T00:00:00
db:JVNDBid:JVNDB-2022-007265date:2023-07-13T00:00:00
db:CNNVDid:CNNVD-202301-1873date:2023-01-26T00:00:00
db:NVDid:CVE-2022-41140date:2023-01-26T18:59:53.690