CVE-2022-1262

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-11 · updated 2026-06-17
Weakness: CWE-78

Description

A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.

Affected products

Dlink Dir-1360 Firmware: 1.02b03, 1.03b02, 1.11b04, 1.00b15, 1.01b03, 1.11b04-beta
Dlink Dir-1760 Firmware: 1.01b04, 1.11b03-beta
Dlink Dir-1960 Firmware: 1.02b01, 1.03b03, 1.11b03, 1.11b03-beta
D-Link DIR-2640: 1.11b02-beta, 1.01b04, 1.11b02
Dlink Dir-2660 Firmware: 1.04b03, 1.11b04, 1.00b14, 1.01b03, 1.02b01, 1.03b04 (+1)
D-Link DIR-3040: 1.13b03-beta, 1.11b02, 1.12b01, 1.13b03, 1.20b03
Dlink Dir-3060 Firmware: 1.00b12, 1.11b04-beta, 1.01b07, 1.02b03, 1.11b02, 1.11b04
D-Link DIR-867: 1.20b10, 1.10b04, 1.30b07
D-Link DIR-878: 1.20b05, 1.30b08
D-Link DIR-882: 1.20b06, 1.30b06, 1.30b10

References

Get alerted when CVE-2022-1262 or the next vulnerability affects your stack