CVE-2022-43628
📋 TL;DR
This vulnerability allows authenticated attackers on the same network to execute arbitrary code with root privileges on D-Link DIR-1935 routers by exploiting improper input validation in IPv6 firewall settings. The authentication mechanism can be bypassed, enabling remote code execution. Only D-Link DIR-1935 routers running firmware version 1.03 are affected.
💻 Affected Systems
- D-Link DIR-1935
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full root control of the router, enabling traffic interception, network pivoting, malware deployment, and persistent backdoor installation.
Likely Case
Local network attacker compromises the router to intercept traffic, modify DNS settings, or deploy ransomware to connected devices.
If Mitigated
With network segmentation and strict access controls, impact is limited to isolated network segments.
🎯 Exploit Status
Exploit requires authentication bypass then command injection. ZDI advisory includes technical details that could be weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.04 or later
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Administration > Firmware Update. 3. Download firmware 1.04+ from D-Link support site. 4. Upload and apply firmware update. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable IPv6 Firewall Management
allDisable IPv6 firewall settings in router configuration to prevent exploitation vector
Restrict Management Interface Access
allConfigure firewall rules to only allow management access from trusted IP addresses
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN with strict access controls
- Implement network monitoring for suspicious SetIPv6FirewallSettings requests
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: Login > Status > Device Info > Firmware VersionCheck Version:
curl -s http://router-ip/status.asp | grep 'Firmware Version'Verify Fix Applied:
Verify firmware version is 1.04 or higher in Device Info page📡 Detection & Monitoring
Log Indicators:
- Unusual SetIPv6FirewallSettings requests
- Multiple authentication failures followed by successful login
- Suspicious system command execution in logs
Network Indicators:
- POST requests to /goform/SetIPv6FirewallSettings with shell metacharacters
- Unusual outbound connections from router
SIEM Query:
source="router-logs" AND (uri_path="/goform/SetIPv6FirewallSettings" OR cmd="*;*" OR cmd="*|*")