CVE-2022-40799 D-Link DNR-322L: software flaw
In plain words: A mistake in the software that attackers have found a way to abuse. Depends on the product — see the description and the vendor advisory.
Confirmed exploited by CISA on · US federal patch deadline Aug 26, 2025
What to do
- Install D-Link's security update for DNR-322L. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Turn on automatic firmware updates and replace gear the maker no longer supports.
- Change default passwords and switch off remote administration and features you do not use.
- Do not put storage boxes or cameras directly on the internet — use the maker's app or a VPN.
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Taken over in bulk to join botnets, used to watch your traffic, or — for storage boxes — locked by ransomware.
The details
- Official name
- D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
- Product
- D-Link DNR-322L
- CISA description
- D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Type of flaw
- Software flaw (CWE-494)
- Confirmed exploited
- Aug 5, 2025
- US federal patch deadline
- Aug 26, 2025
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2022-40799 ·
Questions about CVE-2022-40799
Is CVE-2022-40799 being exploited?
Yes. CISA added CVE-2022-40799 to its Known Exploited Vulnerabilities catalog on Aug 5, 2025, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2022-40799?
Install D-Link's security update for DNR-322L. If no update exists, follow the vendor's workaround or stop using the product until one ships. Turn on automatic firmware updates and replace gear the maker no longer supports.
Am I affected by CVE-2022-40799?
Only if you use D-Link DNR-322L. This one is aimed at devices or apps of the kind people own.