Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2022-36786

DLINK - DSL-224 Post-auth RCE.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
INCD

Description

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

D-Link DSL-224

Default version status: unaffected

  • All versions to < Update to version 3.0.9_Beta Hotfixaffected

References