What is the CVSS score of CVE-2022-1262?

CVE-2022-1262 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.2%.

Is there a public PoC exploit available for CVE-2022-1262?

Yes, a public proof-of-concept exploit is available for CVE-2022-1262. Prioritise patching immediately. EPSS: 2.2%.

Dir 867 Firmware CVE-2022-1262

HIGH

OS Command Injection (CWE-78)

2022-04-11 vulnreport@tenable.com

Command Injection D-Link Dir 867 Firmware Dir 878 Firmware Dir 882 Firmware Dir 3060 Firmware Dir 3040 Firmware Dir 1360 Firmware Dir 1760 Firmware Dir 1960 Firmware Dir 2640 Firmware Dir 2660 Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Apr 11, 2022 - 20:15 nvd

HIGH 7.8

DescriptionNVD

A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.

AnalysisAI

A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root. Affected products include: Dlink Dir-1360 Firmware, Dlink Dir-1760 Firmware, Dlink Dir-1960 Firmware, Dlink Dir-2640 Firmware, Dlink Dir-2660 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.