CVE-2022-43620
📋 TL;DR
This vulnerability allows network-adjacent attackers to bypass authentication on D-Link DIR-1935 routers by exploiting improper HNAP login request handling. Attackers can gain unauthorized access to router administration without credentials. Only users of affected D-Link DIR-1935 routers with vulnerable firmware are impacted.
💻 Affected Systems
- D-Link DIR-1935
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise allowing attacker to change network settings, intercept traffic, install malware, or use router as pivot point into internal network
Likely Case
Unauthorized access to router admin panel enabling network configuration changes, DNS hijacking, or credential theft
If Mitigated
No impact if router is patched or isolated from untrusted networks
🎯 Exploit Status
Exploit requires network access but no authentication. ZDI advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.04 or later
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
Restart Required: Yes
Instructions:
1. Download firmware 1.04+ from D-Link support site. 2. Log into router admin panel. 3. Navigate to System > Firmware Update. 4. Upload and apply new firmware. 5. Wait for router to reboot.
🔧 Temporary Workarounds
Disable HNAP protocol
allDisable HNAP service if not required for functionality
Restrict admin interface access
allLimit router admin access to specific trusted IP addresses only
🧯 If You Can't Patch
- Isolate router on separate VLAN from untrusted devices
- Implement network segmentation to limit lateral movement if compromised
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under System > Firmware. If version is 1.03, router is vulnerable.Check Version:
No CLI command - check via web admin interface at http://router_ipVerify Fix Applied:
After updating, verify firmware version shows 1.04 or later in System > Firmware section.📡 Detection & Monitoring
Log Indicators:
- Multiple failed HNAP login attempts followed by successful login from same IP
- Unauthorized admin access from new IP addresses
Network Indicators:
- Unusual HNAP protocol traffic patterns
- Admin interface access from unexpected network segments
SIEM Query:
source="router_logs" AND (event="HNAP_login" AND result="success") AND NOT src_ip IN [trusted_admin_ips]