CVE-2022-37129: OS Command Injection
D-Link DIR-816 A2v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte4836B0 by snprintf, and finally doSystem(&byte4836B0); will be executed, resulting in a command injection.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-37129.
What is the severity of CVE-2022-37129?
The severity of CVE-2022-37129 is high with a CVSS score of 8.8.
How does the D-Link DIR-816 A2_v1.10CNB04 firmware version 1.10cnb04 being vulnerable to command injection affect the system?
The vulnerability allows an attacker to inject malicious commands into the system, potentially leading to unauthorized access, data loss, or remote code execution.
How can I check if my D-Link DIR-816 router is vulnerable to CVE-2022-37129?
You can check the firmware version of your D-Link DIR-816 router to see if it is running version 1.10cnb04, which is vulnerable to CVE-2022-37129.
How can I fix the command injection vulnerability in the D-Link DIR-816 A2_v1.10CNB04 firmware?
To fix the vulnerability, update the firmware of your D-Link DIR-816 router to a version that has addressed the command injection issue.