Sign-up

ID

VAR-202301-1377


CVE

CVE-2022-43648


TITLE

D-Link Systems, Inc.  of  DIR-3040  Heap-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-022047

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MiniDLNA service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the MiniDLNA service. Was ZDI-CAN-19910. D-Link Systems, Inc. of DIR-3040 A heap-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DIR-3040 is a router of D-Link company in China. Provides the ability to connect to the network

Trust: 2.88

sources: NVD: CVE-2022-43648 // JVNDB: JVNDB-2022-022047 // ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // VULMON: CVE-2022-43648

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-27674

AFFECTED PRODUCTS

vendor:d linkmodel:dir-3040scope: - version: -

Trust: 1.5

vendor:dlinkmodel:dir-3040scope:lteversion:1.20b03

Trust: 1.0

vendor:d linkmodel:dir-3040scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dir-3040scope:lteversion:dir-3040 firmware 1.20b03 and earlier

Trust: 0.8

vendor:d linkmodel:dir-3040 <=v1.20b03scope: - version: -

Trust: 0.6

sources: ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // JVNDB: JVNDB-2022-022047 // NVD: CVE-2022-43648

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-43648
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-43648
value: HIGH

Trust: 1.0

NVD: CVE-2022-43648
value: HIGH

Trust: 0.8

ZDI: CVE-2022-43648
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-27674
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202303-2507
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-27674
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-43648
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-43648
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2022-43648
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // JVNDB: JVNDB-2022-022047 // CNNVD: CNNVD-202303-2507 // NVD: CVE-2022-43648 // NVD: CVE-2022-43648

PROBLEMTYPE DATA

problemtype:CWE-122

Trust: 1.0

problemtype:Heap-based buffer overflow (CWE-122) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022047 // NVD: CVE-2022-43648

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202303-2507

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202303-2507

PATCH

title:D-Link has issued an update to correct this vulnerability.url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10322

Trust: 0.7

title:Patch for D-Link DIR-3040 Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/418641

Trust: 0.6

title:D-Link DIR-3040 Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=232544

Trust: 0.6

sources: ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // CNNVD: CNNVD-202303-2507

EXTERNAL IDS

db:NVDid:CVE-2022-43648

Trust: 4.6

db:ZDIid:ZDI-23-052

Trust: 3.2

db:DLINKid:SAP10322

Trust: 2.5

db:JVNDBid:JVNDB-2022-022047

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-19910

Trust: 0.7

db:CNVDid:CNVD-2023-27674

Trust: 0.6

db:CNNVDid:CNNVD-202303-2507

Trust: 0.6

db:VULMONid:CVE-2022-43648

Trust: 0.1

sources: ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // VULMON: CVE-2022-43648 // JVNDB: JVNDB-2022-022047 // CNNVD: CNNVD-202303-2507 // NVD: CVE-2022-43648

REFERENCES

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10322

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-23-052/

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-43648

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2022-43648/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/122.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-23-052 // CNVD: CNVD-2023-27674 // VULMON: CVE-2022-43648 // JVNDB: JVNDB-2022-022047 // CNNVD: CNNVD-202303-2507 // NVD: CVE-2022-43648

CREDITS

Nicholas Zubrisky

Trust: 0.7

sources: ZDI: ZDI-23-052

SOURCES

db:ZDIid:ZDI-23-052
db:CNVDid:CNVD-2023-27674
db:VULMONid:CVE-2022-43648
db:JVNDBid:JVNDB-2022-022047
db:CNNVDid:CNNVD-202303-2507
db:NVDid:CVE-2022-43648

LAST UPDATE DATE

2024-08-14T15:26:54.099000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-052date:2023-01-18T00:00:00
db:CNVDid:CNVD-2023-27674date:2023-04-14T00:00:00
db:VULMONid:CVE-2022-43648date:2023-03-30T00:00:00
db:JVNDBid:JVNDB-2022-022047date:2023-11-15T03:14:00
db:CNNVDid:CNNVD-202303-2507date:2023-04-10T00:00:00
db:NVDid:CVE-2022-43648date:2023-04-08T01:58:01.873

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-052date:2023-01-18T00:00:00
db:CNVDid:CNVD-2023-27674date:2023-04-14T00:00:00
db:VULMONid:CVE-2022-43648date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2022-022047date:2023-11-15T00:00:00
db:CNNVDid:CNNVD-202303-2507date:2023-03-29T00:00:00
db:NVDid:CVE-2022-43648date:2023-03-29T19:15:21.390