2022-08-14 14:56:22 +00:00
id : CVE-2022-28955
info :
2023-02-03 17:34:52 +00:00
name : D-Link DIR-816L - Improper Access Control
2022-08-14 14:56:22 +00:00
author : arafatansari
2022-08-14 17:41:37 +00:00
severity : high
2022-08-14 14:56:22 +00:00
description : |
2023-02-03 16:23:59 +00:00
D-Link DIR-816L_FW206b01 is susceptible to improper access control. An attacker can access folders folder_view.php and category_view.php and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information or control of the affected router.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest firmware update provided by D-Link to fix the access control issue.
2022-08-14 14:56:22 +00:00
reference :
- https://github.com/shijin0925/IOT/blob/master/DIR816/1.md
2022-08-15 22:35:06 +00:00
- https://www.dlink.com/en/security-bulletin/
2023-02-03 16:23:59 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-28955
2024-03-23 09:28:19 +00:00
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
2022-08-14 17:41:37 +00:00
classification :
2022-08-15 22:35:06 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.5
2022-08-14 17:41:37 +00:00
cve-id : CVE-2022-28955
2022-08-15 22:35:06 +00:00
cwe-id : CWE-287
2024-01-14 13:49:27 +00:00
epss-score : 0.02487
2024-03-23 09:28:19 +00:00
epss-percentile : 0.89836
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:o:dlink:dir-816l_firmware:206b01:*:*:*:*:*:*:*
2022-08-14 14:56:22 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : dlink
product : dir-816l_firmware
2023-09-06 11:59:08 +00:00
shodan-query : http.html:"DIR-816L"
2024-01-14 09:21:50 +00:00
tags : cve2022,cve,dlink,exposure
2022-08-14 14:56:22 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-08-14 17:41:37 +00:00
- method : GET
path :
- "{{BaseURL}}/category_view.php"
- "{{BaseURL}}/folder_view.php"
2022-08-14 14:56:22 +00:00
2022-08-14 17:41:37 +00:00
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2022-08-14 14:56:22 +00:00
matchers-condition : and
matchers :
- type : word
words :
- '<title>SharePort Web Access</title>'
2022-08-14 17:41:37 +00:00
- type : status
status :
- 200
2024-01-26 08:31:11 +00:00
# digest: 490a0046304402203592da06bcc4cba34a72d1962715d8db6d7e4706f92906990dfcd8e323f38bc8022077b65af109b146a3d25aa52ca8c962b18dec5ff877341fbddd9dac83ee18becd:922c64590222798bb761d5b6d8e72950