CVE-2022-26258 D-Link DIR-820L: command or code injection
In plain words: The program treats text it receives as instructions instead of plain data. The attacker can run commands on the machine — often the whole device is taken over.
Confirmed exploited by CISA on · US federal patch deadline Sep 29, 2022
What to do
- Install D-Link's security update for DIR-820L. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Turn on automatic firmware updates and replace gear the maker no longer supports.
- Change default passwords and switch off remote administration and features you do not use.
- Do not put storage boxes or cameras directly on the internet — use the maker's app or a VPN.
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Taken over in bulk to join botnets, used to watch your traffic, or — for storage boxes — locked by ransomware.
The details
- Official name
- D-Link DIR-820L Remote Code Execution Vulnerability
- Product
- D-Link DIR-820L
- CISA description
- D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
- Type of flaw
- Command or code injection (CWE-78)
- Confirmed exploited
- Sep 8, 2022
- US federal patch deadline
- Sep 29, 2022
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2022-26258 ·
Questions about CVE-2022-26258
Is CVE-2022-26258 being exploited?
Yes. CISA added CVE-2022-26258 to its Known Exploited Vulnerabilities catalog on Sep 8, 2022, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2022-26258?
Install D-Link's security update for DIR-820L. If no update exists, follow the vendor's workaround or stop using the product until one ships. Turn on automatic firmware updates and replace gear the maker no longer supports.
Am I affected by CVE-2022-26258?
Only if you use D-Link DIR-820L. This one is aimed at devices or apps of the kind people own.