CVE-2023-27216
HighCVSS 8.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
Risk Assessment
An attacker can gain full control over the device, leading to compromise of network confidentiality, integrity, and availability, and potential use of the router as a pivot for further attacks.
Recommendation
Immediately update the firmware of the D-Link DSL-3782 to the latest available version if a patch has been released, or consider replacing the device with a model not affected by this vulnerability.
Other vulnerabilities in D-Link DSL-3782
See all- CVE-2022-35192High
An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending crafted User or Pwd parameters to Login.asp. The vulnerability affects firmware version v1.01.
- CVE-2022-35191Medium
An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending a crafted HTTP request. The vulnerability exists in firmware version v1.01.
Original NVD description (English source)
An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.