CVE-2022-40719

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15906.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
D-Link	DIR-2150	4.0.1

References

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1223/Third Party Advisory, VDB Entry
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1223/Third Party Advisory, VDB Entry

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-407208.8This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 router CVE-2022-407219.8Arbitrary file upload vulnerability in php uploader CVE-2022-407225.8A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticator CVE-2022-407236.5The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under cert CVE-2022-407248.8The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GE CVE-2022-407256.1PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts CVE-2022-407327.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Wind CVE-2022-407336.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Wind CVE-2022-407346.5UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary CVE-2022-407357.5The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, beca CVE-2022-407366.5An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp.CVE-2022-407376.5An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located