CVE-2022-41140
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-41140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13796.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
栈缓冲区溢出
Source: NVD (National Vulnerability Database)
Vulnerability Title
D-Link 多款路由器缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
D-Link DIR-878等都是中国友讯（D-Link）公司的一款无线路由器。 D-Link 多款路由器存在安全漏洞，该漏洞源于路由器中使用的 lighttpd 服务在将用户输入信息复制到特定缓冲区之前，未对输入信息进行长度验证。处于相邻网络的攻击者利用该漏洞可以执行任意代码。以下产品及版本受到影响：D-Link DIR-867,DIR-878,DIR-882。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| D-Link | Multiple Routers | 1.30B07 | - |
II. Public POCs for CVE-2022-41140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-41140
请登录查看更多情报信息。
Same Patch Batch · D-Link · 2023-01-26 · 5 CVEs total
| CVE-2022-40717 | D-Link DIR-2150 缓冲区错误漏洞 | |
| CVE-2022-40718 | D-Link DIR-2150 缓冲区错误漏洞 | |
| CVE-2022-40719 | D-Link DIR-2150 操作系统命令注入漏洞 | |
| CVE-2022-40720 | D-Link DIR-2150 操作系统命令注入漏洞 |
IV. Related Vulnerabilities
Same product: Multiple Routers
- CVE-2025-2773
BEC Technologies Multiple Routers sys ping Command Injection - CVE-2025-2772
BEC Technologies Multiple Routers Insufficiently Protected C - CVE-2025-2771
BEC Technologies Multiple Routers Authentication Bypass Vuln - CVE-2025-2770
BEC Technologies Multiple Routers Cleartext Password Storage - CVE-2021-34983
NETGEAR Multiple Routers httpd Missing Authentication for Cr
Same vendor: D-Link
- CVE-2026-8273
D-Link DNS-320 system_mgr.cgi cgi_merge_user os command inje - CVE-2026-8272
D-Link DNS-320 webfile_mgr.cgi chown os command injection - CVE-2026-8271
D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command inje - CVE-2026-8260
D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings - CVE-2026-7857
D-Link DI-8100 CGI user_group.asp sprintf buffer overflow
Same weakness: CWE-121
- CVE-2026-8258
Squirrel sqstdstring.cpp validate_format stack-based overflo - CVE-2026-8234
EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based - CVE-2026-6665
PgBouncer buffer overflow in SCRAM - CVE-2026-41509
Integer underflow in crypto_sign_open() leads to buffer over - CVE-2026-8138
Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based
V. Comments for CVE-2022-41140
No comments yet