CVE-2022-37125

D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost

published August 31, 2022

CVSS
—
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

⚠️ A crafty command injection resides in the D-Link DIR-816 — it’s like a sneaky guest who can rearrange the whole party without an invitation! 🎉 Think of the router as a restaurant's kitchen, where this vulnerability allows an unauthorized diner to slip in orders that could change the entire menu without the chef's knowledge. Just one faulty command could lead to total chaos behind the scenes! If exploited, an attacker could potentially run any command on the device, leading to unauthorized access or control over your network — a recipe for disaster! Imagine someone manipulating your connected devices and wreaking havoc without you even realizing it.

Put simply

Think of the router as a restaurant's kitchen, where this vulnerability allows an unauthorized diner to slip in orders that could change the entire menu without the chef's knowledge. Just one faulty command could lead to total chaos behind the scenes! This command injection vulnerability in the D-Link DIR-816 allows attackers to send crafted requests to the /goform/NTPSyncWithHost endpoint, executing arbitrary commands on the affected device.

What to do

If exploited, an attacker could potentially run any command on the device, leading to unauthorized access or control over your network — a recipe for disaster! Imagine someone manipulating your connected devices and wreaking havoc without you even realizing it. To safeguard your network, consider updating to the latest firmware version provided by D-Link. Additionally, regularly review device settings and configurations to ensure no unauthorized changes have slipped through. You've got this! With these steps, you'll keep your network safe and secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03171 · 87.9th percentile
Published
2022-08-31T21:42Z
EPSS history
Timeline
  • 31 AUG 21:42Z
    D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost
    cvelistv5