CVE-2022-28895

Vulnerability

The vulnerability is a command injection in the /setnetworksettings/IPAddress endpoint of D-Link DIR882 router firmware version DIR882A1_FW130B06. The IPAddress parameter is not properly sanitized, allowing injection of arbitrary system commands.

Exploitation

An attacker can send a crafted HTTP request to the /setnetworksettings/IPAddress endpoint with a malicious payload in the IPAddress parameter. No authentication is required if the endpoint is exposed. The injected commands are executed with root privileges due to the context of the web server.

Impact

Successful exploitation allows an attacker to execute arbitrary commands as root, leading to full compromise of the device. This includes the ability to modify system settings, install malware, or pivot to other network hosts.

Mitigation

As of the publication date (2022-05-10), no official patch or workaround has been disclosed by D-Link. The reference [1] provides a general security bulletin page but no specific fix. Users should monitor D-Link's security advisories for updates. If the device is no longer supported, consider replacing it.