CVE-2022-43642: D-Link DIR-825/EE xupnpd YouTube Plugin Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-19222.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-43642?
CVE-2022-43642 is a vulnerability that allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers.
How severe is CVE-2022-43642?
CVE-2022-43642 has a severity score of 8.8, which is considered high.
What is the affected software for CVE-2022-43642?
The affected software for CVE-2022-43642 is D-Link DIR-825 1.0.9/EE routers.
How can an attacker exploit CVE-2022-43642?
An attacker can exploit CVE-2022-43642 by executing arbitrary code through the YouTube plugin for the xupnpd service on the router.
Is authentication required to exploit CVE-2022-43642?
No, authentication is not required to exploit CVE-2022-43642.