CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-41140 – D-Link Multiple Routers lighttpd Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-41140
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10291 https://www.zerodayinitiative.com/advisories/ZDI-22-1290 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-28896
https://notcve.org/view.php?id=CVE-2022-28896
A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload. Una vulnerabilidad de inyección de comandos en el componente /setnetworksettings/SubnetMask de D-Link DIR882 versión DIR882A1_FW130B06, permite a atacantes escalar privilegios a root por medio de una carga útil diseñada • https://github.com/EPhaha/IOT_vuln/tree/main/d-link/dir-882/2 https://www.dlink.com/en/security-bulletin • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-28895
https://notcve.org/view.php?id=CVE-2022-28895
A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload. Una vulnerabilidad de inyección de comandos en el componente /setnetworksettings/IPAddress de D-Link DIR882 versión DIR882A1_FW130B06, permite a atacantes escalar privilegios a root por medio de una carga útil diseñada • https://github.com/EPhaha/IOT_vuln/tree/main/d-link/dir-882/1 https://www.dlink.com/en/security-bulletin • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-28901
https://notcve.org/view.php?id=CVE-2022-28901
A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload. Una vulnerabilidad de inyección de comandos en el componente /SetTriggerLEDBlink/Blink de D-Link DIR882 versión DIR882A1_FW130B06, permite a atacantes escalar privilegios a root por medio de una carga útil diseñada • https://github.com/EPhaha/IOT_vuln/tree/main/d-link/dir-882/3 https://www.dlink.com/en/security-bulletin • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-28571
https://notcve.org/view.php?id=CVE-2022-28571
D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli. Se ha detectado que D-link 882 DIR882A1_FW130B06 contiene una vulnerabilidad de inyección de comandos en "/usr/bin/cli" • https://github.com/F0und-icu/TempName/tree/main/Dlink-882 https://www.dlink.com/en/security-bulletin • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •