CVE-2022-43629

Vulnerability

This vulnerability exists in the handling of SetSysEmailSettings requests to the web management portal of D-Link DIR-1935 routers running firmware version DIR1935A1_FW1.03B02_Beta_ipv6_default_gateway_20181224.bin (also referred to as v1.03b02) [1],[2]. The process does not properly validate a user-supplied string when parsing subelements within SetSysEmailSettings, leading to command injection. Although authentication is required, the existing authentication mechanism can be bypassed [2].

Exploitation

An attacker must be on the same network as the target router (network-adjacent) and send a crafted SetSysEmailSettings request to the web management portal. The attacker can bypass authentication, then inject arbitrary system commands through the unvalidated string parameter. No user interaction beyond authentication bypass is required [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of root, resulting in full compromise of the router. The attacker can read, modify, or delete sensitive data, install malware, or pivot to other network devices [2].

Mitigation

D-Link has not released a patched firmware version for the DIR-1935 as of the publication date; the device is likely end-of-life [1]. Users should segregate the router from untrusted networks and disable remote management. No workaround other than upgrading to a supported device is known [2].