CVE-2022-42161 - OpenCVE

D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dlink	Covr 1200 Covr 1200 Firmware Covr 1202 Covr 1202 Firmware Covr 1203 Covr 1203 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:dlink:covr_1203_firmware:1.08:*:*:*:*:*:*:*

cpe:2.3:h:dlink:covr_1203:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:dlink:covr_1202_firmware:1.08:*:*:*:*:*:*:*

cpe:2.3:h:dlink:covr_1202:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:dlink:covr_1200_firmware:1.08:*:*:*:*:*:*:*

cpe:2.3:h:dlink:covr_1200:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
https://www.dlink.com/en/security-bulletin/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-10-13T00:00:00

Updated: 2024-08-03T13:03:45.339Z

Reserved: 2022-10-03T00:00:00

Link: CVE-2022-42161

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-10-13T19:15:10.347

Modified: 2022-10-18T12:14:08.107

Link: CVE-2022-42161

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:covr_1203_firmware:1.08:*:*:*:*:*:*:*", "matchCriteriaId": "20CA5BC8-32DE-4149-927C-ABA0AC1B5720", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:covr_1203:-:*:*:*:*:*:*:*", "matchCriteriaId": "39D681AD-9862-48E9-B3BA-4B451368DFF1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:covr_1202_firmware:1.08:*:*:*:*:*:*:*", "matchCriteriaId": "A26A1D64-2849-4DF1-A9C4-953DFDA12749", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:covr_1202:-:*:*:*:*:*:*:*", "matchCriteriaId": "923DBF6D-2E55-48D8-AD31-D2844185E07F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:covr_1200_firmware:1.08:*:*:*:*:*:*:*", "matchCriteriaId": "E6312D17-5579-4F89-9671-F6256F6142A9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:covr_1200:-:*:*:*:*:*:*:*", "matchCriteriaId": "E62503AD-4C72-4615-8C70-F5116F7948F0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS."}, {"lang": "es", "value": "Se ha detectado que D-Link COVR 1200,1202,1203 versi\u00f3n v1.08, contiene una vulnerabilidad de inyecci\u00f3n de comandos por medio del par\u00e1metro /SetTriggerWPS/PIN en la funci\u00f3n SetTriggerWPS"}], "id": "CVE-2022-42161", "lastModified": "2022-10-18T12:14:08.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-13T19:15:10.347", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.dlink.com/en/security-bulletin/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}