CVE-2022-26258
D-Link DIR-820L Remote Code Execution Vulnerability
Description
CVE-2022-26258 is a remote code execution vulnerability in the D-Link DIR-820L router, specifically in the Device Name parameter of /lan.asp. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected router. As the DIR-820L is an end-of-life product, D-Link recommends disconnecting the device if still in use. With an EPSS score of 87.16% (99.44th percentile), this vulnerability is highly likely to be exploited. CISA added CVE-2022-26258 to the KEV catalog on September 8, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-820l firmware | 1.05b03 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0(Broken Link, Exploit, Third Party Advisory)
- https://github.com/zhizhuoshuma/cve_info_data/blob/ccaed4b94ba762eb8a8e003bfa762a7754b8182e/Vuln/Vuln/DIR-820L/command_execution_0/README.md(Exploit, Third Party Advisory)
- https://www.dlink.com/en/security-bulletin/(Not Applicable, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26258(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-26258 exploits an OS command injection vulnerability in the D-Link DIR-820L router's web interface. The Device Name parameter in /lan.asp is not properly sanitized before being used in system commands, allowing attackers to inject and execute arbitrary operating system commands.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2022-26258 allows unauthenticated remote code execution on D-Link DIR-820L routers, providing attackers with complete control over the network gateway device. Confidentiality is critically impacted as the router has visibility into all network traffic. Integrity is compromised as the attacker can modify router configurations, DNS settings, and firmware. Availability is affected as the attacker can disrupt network connectivity. Compromised routers are commonly used for botnet participation, DNS hijacking, man-in-the-middle attacks, and as pivot points into internal networks. The end-of-life status means no patches will be released, making device replacement the only remediation.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-26258 and added it to the KEV catalog on September 8, 2022, with a remediation deadline of September 29, 2022. The EPSS score of 87.16% (99.44th percentile) indicates very high exploitation probability. The vulnerability has been incorporated into IoT botnet malware such as Mirai variants. The ransomware association is classified as unknown. The end-of-life status of the DIR-820L ensures a persistent vulnerable population.
Remediation
- Replace the D-Link DIR-820L: As an end-of-life product, no security patches will be released. Replace the device with a currently supported router.
- Disconnect immediately: If replacement is not immediately possible, disconnect the DIR-820L from the network to prevent exploitation.
- Disable remote management: If the device must remain temporarily connected, disable all remote management features and restrict access to the web interface.
- Monitor for compromise indicators: Check for unusual DNS configurations, unexpected firmware modifications, and abnormal network traffic patterns from the router.
- Implement network segmentation: Place IoT and legacy devices on isolated network segments to limit the blast radius of any compromise.
Technical Details
CVE-2022-26258 is a command injection vulnerability in the D-Link DIR-820L router's web management interface. The vulnerability exists in the handling of the Device Name parameter submitted to /lan.asp. When a user sets or modifies the device name through the web interface, the input is incorporated into system-level commands without proper sanitization. An attacker can inject shell metacharacters and commands through this parameter, which are then executed on the router's operating system with root privileges. The web interface on consumer routers typically runs as root, so any command injection vulnerability provides full system access. The D-Link DIR-820L reached end-of-life, meaning D-Link will not release firmware updates to address this vulnerability.
Frequently Asked Questions
Is CVE-2022-26258 being actively exploited?
Yes, CVE-2022-26258 is actively exploited, particularly by IoT botnet malware. CISA added it to the KEV catalog on September 8, 2022, and the EPSS score of 87.16% confirms widespread exploitation.
What products are affected by CVE-2022-26258?
CVE-2022-26258 affects the D-Link DIR-820L router, which is an end-of-life product that will not receive security updates.
How do I fix CVE-2022-26258?
The DIR-820L is end-of-life with no patch available. The only remediation is to replace the device with a supported router model.
How severe is CVE-2022-26258?
CVE-2022-26258 is a critical command injection vulnerability with an EPSS score of 87.16% (99.44th percentile). The end-of-life status of the affected device means the only solution is replacement.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.