High severity · published Apr 11, 2022
CVE-2022-1262
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root
7.8
CVSS
2.2%
EPSS
No
On KEV
Description
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-1360 Firmware · Dlink
1.02b03; 1.03b02; 1.11b04; 1.00b15; 1.01b03; 1.11b04 · source: NVD
DF
Dir-1760 Firmware · Dlink
1.01b04; 1.11b03 · source: NVD
DF
Dir-1960 Firmware · Dlink
1.02b01; 1.03b03; 1.11b03; 1.11b03 · source: NVD
DF
Dir-2640 Firmware · Dlink
1.11b02; 1.01b04; 1.11b02 · source: NVD
DF
Dir-2660 Firmware · Dlink
1.04b03; 1.11b04; 1.00b14; 1.01b03; 1.02b01; 1.03b04; +1 more · source: NVD
DF
Dir-3040 Firmware · Dlink
1.13b03; 1.11b02; 1.12b01; 1.13b03; 1.20b03 · source: NVD
DF
Dir-3060 Firmware · Dlink
1.00b12; 1.11b04; 1.01b07; 1.02b03; 1.11b02; 1.11b04 · source: NVD
DF
Dir-867 Firmware · Dlink
1.20b10; 1.10b04; 1.30b07 · source: NVD
DF
Dir-878 Firmware · Dlink
1.20b05; 1.30b08 · source: NVD
DF
Dir-882 Firmware · Dlink
1.20b06; 1.30b06; 1.30b10 · source: NVD