CVE-2022-32092
📋 TL;DR
This CVE describes a command injection vulnerability in D-Link DIR-645 routers where attackers can execute arbitrary commands via the QUERY_STRING parameter in the __ajax_explorer.sgi endpoint. This affects all users of DIR-645 v1.03 routers, allowing remote code execution with high privileges.
💻 Affected Systems
- D-Link DIR-645
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router, allowing attackers to install persistent malware, intercept network traffic, pivot to internal networks, and use the device for botnet activities.
Likely Case
Router takeover leading to DNS hijacking, credential theft from connected devices, and use as a proxy for malicious activities.
If Mitigated
Limited impact if router is behind firewall with strict inbound rules and network segmentation prevents lateral movement.
🎯 Exploit Status
Public exploit code exists in GitHub repositories. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: No
Instructions:
No official patch available. D-Link has not released updated firmware for this end-of-life product. Consider replacement.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent external access to router management interface
Login to router admin > Advanced > Remote Management > Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected routers with supported models
- Implement strict firewall rules blocking all inbound traffic to router management ports (80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.03, device is vulnerable.Check Version:
Check via web interface: http://router-ip/ or via SSH if enabledVerify Fix Applied:
No fix available to verify. Only complete mitigation is device replacement.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to __ajax_explorer.sgi
- Commands with shell metacharacters in QUERY_STRING
- Unexpected process execution in router logs
Network Indicators:
- HTTP requests to router IP with suspicious QUERY_STRING parameters
- Outbound connections from router to unknown IPs
SIEM Query:
source="router_logs" AND (uri="*__ajax_explorer.sgi*" AND query_string="*;*" OR query_string="*|*" OR query_string="*`*" OR query_string="*$(*")