ZDI-22-1223: D-Link DIR-2150 xupnpd_generic Plugin Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpdgeneric.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-1223?
The severity of ZDI-22-1223 is high due to the potential for remote code execution without authentication.
How do I fix ZDI-22-1223?
To fix ZDI-22-1223, update the firmware of the D-Link DIR-2150 router to the latest available version from D-Link.
What does ZDI-22-1223 allow attackers to do?
ZDI-22-1223 allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers.
Is authentication required to exploit ZDI-22-1223?
No, authentication is not required to exploit the ZDI-22-1223 vulnerability.
Which devices are affected by ZDI-22-1223?
The devices affected by ZDI-22-1223 are D-Link DIR-2150 routers.