CVE-2022-43621 HIGH

CVE-2022-43621

Vendor D-Link

Product DIR-1935

Weakness CWE-697

Published March 29, 2023

Last update February 18, 2025

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an incorrectly implemented comparison. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16152.

Key dates

02Disclosure timeline

March 29, 2023 CVE published

February 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-43621 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/697.html

Related vulnerabilities

CVE-2022-43621

01Description

02Disclosure timeline

03References

04Related CVE