CVE-2022-40720

HIGH

D-Link DIR-2150 Firmware < 4.0.1 - Unauthenticated OS Command Injection via Dreambox Plugin

Title source: llm

Description

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Dreambox plugin for the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the router. Was ZDI-CAN-15935.

References (2)

Core 2

Core References

Patch, Vendor Advisory

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304

Third Party Advisory, VDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-22-1224/

Scores

CVSS v3 8.8

EPSS 0.0155

EPSS Percentile 81.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

dlink/dir-2150_firmware < 4.0.1

Published Jan 26, 2023

Tracked Since Feb 18, 2026