CVE-2022-43184: OS Command Injection

Published Oct 19, 2022

Updated

D-Link DIR878 1.30B08 Hotfix04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.

Affected Software

4 affected components

Dlink Dir-878 Firmware=1.30b08-hotfix_04

Dlink Dir-878

All of the following

Dlink Dir-878 Firmware=1.30b08-hotfix_04

Dlink Dir-878

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade D-Link DIR878 to a version that resolves this vulnerability.
Fixed in 1.30B08Patch Hotfix_04
Compensating control
Mitigate the command injection vulnerability in /bin/proc.cgi by blocking/restricting access to the affected CGI endpoint (/bin/proc.cgi) from untrusted networks until Hotfix_04 for DIR878 1.30B08 is applied.

Oct 19, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

CVE-2022-43184 is a command injection vulnerability found in D-Link DIR878 1.30B08 Hotfix_04 firmware.

CVE-2022-43184 is classified as critical with a severity value of 9.8.

The affected software version is D-Link DIR878 1.30B08 Hotfix_04 firmware.

The references for CVE-2022-43184 are: https://github.com/HuangPayoung/CVE-request/tree/main/DLink/vuln2, https://www.dlink.com/en/security-bulletin/

To fix CVE-2022-43184, update your D-Link DIR878 firmware to a version that has addressed the vulnerability.