CVE-2022-43632

Vulnerability

The vulnerability exists in the SetQoSSettings functionality of D-Link DIR-1935 routers, firmware version DIR1935A1_FW1.03B02_Beta_ipv6_default_gateway_20181224.bin (Rev. Ax) [1]. When parsing subelements within the QoSInfo element of a SetQoSSettings request, the process does not properly validate a user-supplied string before using it in a system call, leading to command injection [2].

Exploitation

An attacker must be network-adjacent to the target router and have administrative access to the web management portal. However, the authentication mechanism can be bypassed [2]. The attacker sends a specially crafted SetQoSSettings request containing a malicious QoSInfo payload. The lack of validation allows the injected commands to be executed via a system call.

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands in the context of root, leading to full compromise of the router's confidentiality, integrity, and availability [2].

Mitigation

D-Link has acknowledged the vulnerability and stated that they began developing security patches [1]. As of the publication date, no firmware update has been released to fix this specific issue. Users should monitor D-Link's support page for updates and consider limiting access to the web management interface to trusted networks only.