What is CVE-2022-36786?

CVE-2022-36786 is a critical-severity vulnerability in D-Link Dsl-224, classified under Command Injection. CVSS score: 9.9/10. Published 2022-11-17.

How severe is CVE-2022-36786?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in D-Link Dsl-224

CVE-2022-36786

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (54.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

D-link Dsl-224 — versions All versions
Dlink Dsl-224
Dlink Dsl-224_firmware

Weakness classification (CWE)

CWE-77 — Command Injection

References

cna@cyber.gov.il (Third Party Advisory)

Frequently asked questions

What is CVE-2022-36786?: CVE-2022-36786 is a critical-severity vulnerability in D-Link Dsl-224, classified under Command Injection. CVSS score: 9.9/10. Published 2022-11-17.
How severe is CVE-2022-36786?: Critical severity. CVSS v3 base score is 9.9 out of 10.