CVE-2022-43643: falha de alta gravidade em D-Link DIR-825
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 1.9%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Generic plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-19460.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
D-Link · DIR-825CVEs relacionadas — D-Link DIR-825
No mesmo produto, das mais perigosas para as menos.
CVE-2025-7206CRITICALD-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflowEPSS 21.7%CVE-2024-0717MEDIUMD-Link Good Line Router v2 HTTP GET Request devinfo information disclosureEPSS 18.2%CVE-2025-10666HIGHD-Link DIR-825 apply.cgi sub_4106d4 buffer overflowEPSS 3.4%CVE-2026-4627HIGHD-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so handler_update_system_time os command injectionEPSS 2.1%CVE-2026-7068HIGHD-Link DIR-825 nmbd sserver.c NMBD_process buffer overflowEPSS 1.9%CVE-2026-7069HIGHD-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflowEPSS 1.4%