Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-36786

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.

Published

2022-11-17T23:15:17.010

Last Modified

2025-04-29T20:15:20.280

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.9 (CRITICAL)

Weaknesses
  • Type: Primary
    CWE-77
  • Type: Secondary
    CWE-77
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System dlink dsl-224_firmware - Yes
Hardware dlink dsl-224 - No
References