1. Home
  2. CVE Database
  3. CVE-2022-36786
CRITICAL · 9.9

CVE-2022-36786

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this ...

Vulnerability Description

DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.

CVSS Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
DlinkDsl-224 Firmware-
DlinkDsl-224-

Related Weaknesses (CWE)

CWE-77

References

FAQ

What is CVE-2022-36786?

CVE-2022-36786 is a vulnerability with a CVSS score of 9.9 (CRITICAL). DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this ...

How severe is CVE-2022-36786?

CVE-2022-36786 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-36786?

Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dsl-224 Firmware, Dlink Dsl-224.