CVE-2022-46552
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-846 routers via a crafted POST request to the lan(0)_dhcps_staticlist parameter. Attackers can gain full control of affected devices without authentication. All users of vulnerable firmware versions are affected.
💻 Affected Systems
- D-Link DIR-846 Wireless Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, credential theft, network traffic interception, and pivot to internal network devices.
Likely Case
Router takeover for botnet participation, DNS hijacking, credential harvesting, and network disruption.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit requires simple HTTP POST request with command injection payload. Public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Check D-Link support site for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router administration interface
Network Segmentation
allPlace router in isolated network segment with strict firewall rules
🧯 If You Can't Patch
- Replace affected device with supported model
- Implement strict network ACLs to restrict access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System > Firmware. If version is FW100A53DBR, device is vulnerable.Check Version:
curl -s http://router-ip/status.html | grep -i firmwareVerify Fix Applied:
Verify firmware version has changed from FW100A53DBR to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to router management interface
- Commands containing shell metacharacters in HTTP parameters
- Unexpected system processes or file modifications
Network Indicators:
- HTTP POST requests with suspicious payloads to router IP
- Outbound connections from router to unknown destinations
- Unusual DNS queries from router
SIEM Query:
source="router_logs" AND (http_method="POST" AND (uri="*lan*" OR param="*dhcps*")) AND (payload="*;*" OR payload="*|*" OR payload="*`*" OR payload="*$(*")🔗 References
- http://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.html
- https://cwe.mitre.org/data/definitions/78.html
- https://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6e
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php
- https://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.md
- https://www.dlink.com/en/security-bulletin/
- https://www.php.net/manual/en/ref.exec.php
- http://packetstormsecurity.com/files/171710/D-Link-DIR-846-Remote-Command-Execution.html
- https://cwe.mitre.org/data/definitions/78.html
- https://francoataffarel.medium.com/cve-2022-46552-d-link-dir-846-wireless-router-in-firmware-fw100a53dbr-retail-has-a-vulnerability-5b4ca1864c6e
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php
- https://github.com/c2dc/cve-reported/blob/main/CVE-2022-46552/CVE-2022-46552.md
- https://www.dlink.com/en/security-bulletin/
- https://www.php.net/manual/en/ref.exec.php
