CVE-2022-34527

HIGH

D-Link DSL-3782 <= v1.03 - OS Command Injection via byte_4C0160 Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-34527. PoCs published by FzBacon.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2022-34527, a command injection vulnerability in D-Link DSL-3782 routers (firmware v1.03 and below). The exploit leverages a command injection flaw in the Diagnostics.asp page via the Addr parameter, allowing authenticated remote code execution.

Description

D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160.

Exploits (1)

nomisec WORKING POC
by FzBacon · poc
https://github.com/FzBacon/CVE-2022-34527_D-Link_DSL-3782_Router_command_injection

This repository contains a functional exploit for CVE-2022-34527, a command injection vulnerability in D-Link DSL-3782 routers (firmware v1.03 and below). The exploit leverages a command injection flaw in the Diagnostics.asp page via the Addr parameter, allowing authenticated remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link DSL-3782 Router (firmware v1.03 and below)
Auth required
Prerequisites: Authenticated access to the router's web interface · Valid session key
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0414
EPSS Percentile 89.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
dlink/dsl-3782_firmware 1.01
dlink/dsl-3782_firmware 1.03
Published Jul 29, 2022
Tracked Since Feb 18, 2026