CVE-2022-36786 - DLINK - DSL-224 Post-auth RCE. · CoreCVE

Back Back to CVE browser

CRITICAL

DLINK - DSL-224 Post-auth RCE.

Published Nov 17, 2022

9.9

CRITICAL

CVSS 3.1

EPSS 0.91%

Description

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.

Affected products

Vendor D-Link Product DSL-224 Default
unaffected
- Version
  All versions
  Status
  affected
  Constraints
  <Update to version 3.0.9_Beta Hotfix

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
All versions	affected	<Update to version 3.0.9_Beta Hotfix

Remediation

Vendor solution

Update to version 3.0.9_Beta Hotfix

Weaknesses (1)

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39486
Advisory
https://www.gov.il/en/Departments/faq/cve_advisories
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39486		Advisory
https://www.gov.il/en/Departments/faq/cve_advisories		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCD

Published Nov 17, 2022

Updated Apr 29, 2025

Reserved Jul 26, 2022

Link CVE-2022-36786

CISA Vulnrichment

Updated Apr 29, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-36786

Severity n/a

Public date n/a

Links CVE-2022-36786

Assigner INCD

Published Nov 17, 2022

Updated Apr 29, 2025

Exploited since n/a

Link EUVD-2022-39486

EUVD-2022-39486