CVE-2022-43109

D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings

Critical · published November 3, 2022

CVSS v3.1
9.8
EPSS
4%
Percentile
90.0
In the wild
Unconfirmed
What it is

🚨 A crafty packet is all it takes to bend your D-Link DIR-823G to an attacker's will! 🔥 Think of it like a food delivery person slipping a note with secret instructions to the kitchen — if the kitchen staff blindly follow the note without checking, they could end up making a dangerous dish! An attacker could remotely execute arbitrary commands on your router, potentially allowing them to take full control of your network. This is absolutely devastating, as they could intercept data, redirect traffic, or even compromise connected devices. Your entire home network could become playground for malicious activities!

Put simply

Think of it like a food delivery person slipping a note with secret instructions to the kitchen — if the kitchen staff blindly follow the note without checking, they could end up making a dangerous dish! The vulnerability stems from a command injection flaw in the SetNetworkTomographySettings function, which processes crafted packets without proper validation. This oversight allows attackers to execute commands they shouldn't have access to.

What to do

An attacker could remotely execute arbitrary commands on your router, potentially allowing them to take full control of your network. This is absolutely devastating, as they could intercept data, redirect traffic, or even compromise connected devices. Your entire home network could become playground for malicious activities! To protect your network, update your D-Link DIR-823G to the latest firmware version immediately. If possible, change the router's default settings to enhance security and monitor network traffic for anything suspicious. Don't wait! You've got this! By taking swift action, you'll be a security hero and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03823 · 90.0th percentile
Published
2022-11-03T00:00Z
EPSS history
Timeline
  • 03 NOV 00:00Z
    D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings
    cvelistv5