CVE-2022-40799
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
Description
CVE-2022-40799 is a high-severity vulnerability in the D-Link DNR-322L network video recorder that allows an authenticated attacker to execute operating system commands through the Backup Config functionality. The flaw is caused by a data integrity failure where the backup configuration mechanism does not verify the integrity of imported configuration data, enabling code injection. With a CVSS v3.1 score of 8.8, this vulnerability requires low-level authentication and can be exploited remotely over the network. CISA has added CVE-2022-40799 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 26, 2025, and the EPSS score of 40.34% at the 97th percentile indicates very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dnr-322l firmware | <= 2.60b15 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://gitlab.com/lu-ka/cve-2022-40799(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40799(US Government Resource)
- https://www.dlink.com/uk/en/products/dnr-322l-cloud-network-video-recorder(Product)
Weakness Type
CWE-494: Download of Code Without Integrity Check
CVE-2022-40799 is classified under CWE-494 (Download of Code Without Integrity Check), a vulnerability where software processes executable content or configuration data without verifying its integrity. In the D-Link DNR-322L, the Backup Config import functionality does not validate or cryptographically verify configuration files before applying them, allowing an attacker to craft a malicious configuration file that contains embedded operating system commands.
Learn more: CWE-494 — Download of Code Without Integrity Check
Impact Analysis
CVE-2022-40799 enables complete compromise of the D-Link DNR-322L network video recorder. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requiring only low-level authentication (PR:L) and no user interaction (UI:N). Confidentiality (High): successful exploitation grants the attacker access to all video recordings stored on the NVR, camera configurations, network credentials, and any other data managed by the device. Integrity (High): the attacker can modify or delete recordings, alter camera configurations, inject persistent backdoors into the device firmware, and manipulate the NVR's operation. Availability (High): the attacker can disable the NVR, corrupt stored recordings, or render the device inoperable. The EPSS score of 40.34% at the 97th percentile confirms that this vulnerability is being actively targeted. The DNR-322L is commonly deployed in small business and residential surveillance systems, and as a network video recorder, it typically has access to multiple connected cameras, amplifying the impact of a compromise.
Exploit Maturity
CVE-2022-40799 has a mature exploit landscape with publicly available proof-of-concept code. Public exploit code is available via a GitLab repository that details the exploitation technique for the Backup Config data integrity failure. CISA has confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 40.34% at the 97th percentile places this vulnerability among the top 3% most likely to be exploited. The D-Link DNR-322L firmware version 2.60B15 and earlier are affected, and the device has reached end-of-life status, meaning no further patches will be released. This combination of public exploit availability, confirmed exploitation, and no available fix for the current firmware makes CVE-2022-40799 a critical priority for organizations still operating this device.
Remediation
-
Replace the D-Link DNR-322L with a currently supported network video recorder. The DNR-322L has reached end of life and firmware version 2.60B15 is the latest available, which remains vulnerable. D-Link will not release further patches for this product.
-
Isolate the DNR-322L from untrusted networks immediately if replacement is not immediately possible. The device must not be accessible from the internet, and access to its management interface should be restricted to a dedicated, trusted management VLAN.
-
Restrict administrative access to the device by minimizing the number of user accounts and ensuring that only trusted administrators can access the Backup Config functionality. Implement IP-based access controls and strong authentication.
-
Monitor the device for compromise indicators including unexpected configuration changes, unusual outbound network traffic, new or modified files on the device's storage, and anomalous access patterns in the device logs.
-
Implement network segmentation to isolate surveillance equipment from critical business systems. Ensure that even if the NVR is compromised, the attacker cannot pivot to other network resources. Deploy network intrusion detection to alert on exploitation attempts targeting the Backup Config endpoint.
Technical Details
CVE-2022-40799 exploits a data integrity failure in the Backup Config functionality of the D-Link DNR-322L network video recorder running firmware version 2.60B15 or earlier. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity and low authentication requirements. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check) because the configuration import mechanism does not verify the integrity or authenticity of uploaded configuration files. An authenticated attacker can craft a malicious configuration backup file that includes embedded operating system commands. When this file is imported through the Backup Config restore functionality, the device processes the configuration data without validation, causing the embedded commands to execute on the underlying Linux operating system with the privileges of the web server process. The attack leverages the trust the device places in configuration backup files, which are treated as authoritative data sources without cryptographic signature verification or content sanitization.
Frequently Asked Questions
Is CVE-2022-40799 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2022-40799 to the KEV catalog. Public exploit code is available on GitLab, and the EPSS score of 40.34% at the 97th percentile confirms very high exploitation activity.
What products are affected by CVE-2022-40799?
The D-Link DNR-322L network video recorder with firmware version 2.60B15 and earlier is affected. This product has reached end of life and will not receive further security patches.
How do I fix CVE-2022-40799?
There is no patch available as the DNR-322L has reached end of life. The recommended action is to replace the device with a currently supported network video recorder. As an interim measure, isolate the device from untrusted networks and restrict administrative access.
How severe is CVE-2022-40799?
CVE-2022-40799 has a CVSS v3.1 score of 8.8 (High severity) and an EPSS score at the 97th percentile. The combination of public exploit code, confirmed active exploitation, and no available patch makes this an urgent priority requiring device replacement.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.