Sign-up

ID

VAR-202209-1038


CVE

CVE-2022-3210


TITLE

D-Link DIR-2150 Operating System Command Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2025-25601 // CNNVD: CNNVD-202303-2557

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15905. D-Link Systems, Inc. of DIR-2150 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The D-Link DIR-2150 is an AC2100-compliant wireless router that supports dual-band (2.4GHz and 5GHz) wireless transmission, provides four gigabit wired ports, and has a maximum theoretical transmission rate of 2100Mbps. The D-Link DIR-2150 contains an operating system command injection vulnerability

Trust: 2.88

sources: NVD: CVE-2022-3210 // JVNDB: JVNDB-2022-022061 // ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // VULMON: CVE-2022-3210

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-25601

AFFECTED PRODUCTS

vendor:d linkmodel:dir-2150scope: - version: -

Trust: 1.5

vendor:dlinkmodel:dir-2150scope:lteversion:4.0.1

Trust: 1.0

vendor:d linkmodel:dir-2150scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dir-2150scope:lteversion:dir-2150 firmware 4.0.1 and earlier

Trust: 0.8

vendor:d linkmodel:dir-2150scope:eqversion:4.0.1

Trust: 0.6

sources: ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // JVNDB: JVNDB-2022-022061 // NVD: CVE-2022-3210

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-3210
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-3210
value: HIGH

Trust: 1.0

NVD: CVE-2022-3210
value: HIGH

Trust: 0.8

ZDI: CVE-2022-3210
value: HIGH

Trust: 0.7

CNVD: CNVD-2025-25601
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202303-2557
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-25601
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-3210
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-3210
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2022-3210
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // CNNVD: CNNVD-202303-2557 // JVNDB: JVNDB-2022-022061 // NVD: CVE-2022-3210 // NVD: CVE-2022-3210

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022061 // NVD: CVE-2022-3210

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202303-2557

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202303-2557

PATCH

title:D-Link has issued an update to correct this vulnerability.url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304

Trust: 0.7

title:Patch for D-Link DIR-2150 Operating System Command Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/747306

Trust: 0.6

title:D-Link DIR-2150 Fixes for operating system command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=232552

Trust: 0.6

sources: ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // CNNVD: CNNVD-202303-2557

EXTERNAL IDS

db:NVDid:CVE-2022-3210

Trust: 4.6

db:ZDIid:ZDI-22-1222

Trust: 3.8

db:DLINKid:SAP10304

Trust: 2.5

db:JVNDBid:JVNDB-2022-022061

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15905

Trust: 0.7

db:CNVDid:CNVD-2025-25601

Trust: 0.6

db:CNNVDid:CNNVD-202303-2557

Trust: 0.6

db:VULMONid:CVE-2022-3210

Trust: 0.1

sources: ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // VULMON: CVE-2022-3210 // CNNVD: CNNVD-202303-2557 // JVNDB: JVNDB-2022-022061 // NVD: CVE-2022-3210

REFERENCES

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10304

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-22-1222/

Trust: 3.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-3210

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-3210/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1222 // CNVD: CNVD-2025-25601 // VULMON: CVE-2022-3210 // CNNVD: CNNVD-202303-2557 // JVNDB: JVNDB-2022-022061 // NVD: CVE-2022-3210

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-22-1222

SOURCES

db:ZDIid:ZDI-22-1222
db:CNVDid:CNVD-2025-25601
db:VULMONid:CVE-2022-3210
db:CNNVDid:CNNVD-202303-2557
db:JVNDBid:JVNDB-2022-022061
db:NVDid:CVE-2022-3210

LAST UPDATE DATE

2025-11-19T23:02:56.107000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1222date:2022-09-14T00:00:00
db:CNVDid:CNVD-2025-25601date:2025-10-29T00:00:00
db:VULMONid:CVE-2022-3210date:2023-03-30T00:00:00
db:CNNVDid:CNNVD-202303-2557date:2023-04-10T00:00:00
db:JVNDBid:JVNDB-2022-022061date:2023-11-15T03:21:00
db:NVDid:CVE-2022-3210date:2023-04-08T01:57:34.917

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1222date:2022-09-14T00:00:00
db:CNVDid:CNVD-2025-25601date:2025-10-29T00:00:00
db:VULMONid:CVE-2022-3210date:2023-03-29T00:00:00
db:CNNVDid:CNNVD-202303-2557date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2022-022061date:2023-11-15T00:00:00
db:NVDid:CVE-2022-3210date:2023-03-29T19:15:17.103