CVE-2022-46552: OS Command Injection
First published: Thu Feb 02 2023(Updated: )
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dir-846 Firmware | =100a53dbr | |
| Dlink Dir-846 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.html
- https://cwe.mitre.org/data/definitions/78.html
- https://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6e
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php
- https://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.md
- https://www.dlink.com/en/security-bulletin/
- https://www.php.net/manual/en/ref.exec.php
Frequently Asked Questions
What is CVE-2022-46552?
CVE-2022-46552 is a remote command execution (RCE) vulnerability found in D-Link DIR-846 Firmware FW100A53DBR.
How does CVE-2022-46552 impact D-Link DIR-846 Firmware FW100A53DBR?
CVE-2022-46552 allows remote attackers to execute arbitrary commands on the affected device.
What is the severity of CVE-2022-46552?
CVE-2022-46552 has a severity rating of 8.8 (high).
How can CVE-2022-46552 be exploited?
CVE-2022-46552 is exploited through a crafted POST request targeting the lan(0)_dhcps_staticlist parameter.
How can I mitigate the risk of CVE-2022-46552?
To mitigate the risk of CVE-2022-46552, users should update to a patched version of D-Link DIR-846 Firmware FW100A53DBR provided by the vendor.
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/dlink
- canonical/dlink dir-846 firmware
- version/dlink dir-846 firmware/100a53dbr
- canonical/dlink dir-846