D-Link Dir-822+ Firmware vulnerabilities

4 CVEs affecting D-Link Dir-822+ Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-34950, published 2024-05-14.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-33344, published 2024-04-26. Critical severity, CVSS 9.8. EPSS: 19.9% chance of exploitation in the next 30 days. D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to execute arbitrary commands via shell.
• CVE-2024-33343, published 2024-04-26. High severity, CVSS 8.8. EPSS: 8.3% chance of exploitation in the next 30 days. D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.
• CVE-2024-34950, published 2024-05-14. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
• CVE-2024-33342, published 2024-04-26. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. D-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.