CVE-2022-43626

Vulnerability

This vulnerability is a command injection flaw in the SetIPv4FirewallSettings handler of the web management portal on D-Link DIR-1935 routers. When parsing subelements within the IPv4FirewallRule element, the process does not properly validate a user-supplied string before using it to execute a system call. Affected firmware version is v1.03b02 (and possibly earlier). Authentication is required but can be bypassed [1][2].

Exploitation

An attacker must be network-adjacent and have authenticated access to the web management portal, though the existing authentication mechanism can be bypassed. The attacker sends a crafted SetIPv4FirewallSettings request with malicious input in the IPv4FirewallRule subelement, leading to command injection. No user interaction is required [2].

Impact

Successful exploitation allows arbitrary code execution in the context of root, giving the attacker full control over the router. This can lead to disclosure of sensitive information, modification of configuration, or further network attacks [2].

Mitigation

D-Link has released firmware version 1.03b02 to address this vulnerability, as per the advisory SAP10310 [1]. Users should update to the latest firmware. No workarounds are mentioned. The vulnerability is not listed in CISA KEV as of now [1][2].