CVE-2022-38873

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-20 · updated 2026-06-17
Weakness: CWE-345

Description

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

Affected products

Dlink Dap-2310 Firmware: through 2.10rc036
Dlink Dap-2330 Firmware: through 1.06rc020
Dlink Dap-2360 Firmware: through 2.10rc050
Dlink Dap-2553 Firmware: through 3.10rc031
Dlink Dap-2660 Firmware: through 1.15rc093
Dlink Dap-2690 Firmware: through 3.20rc106
D-Link DAP-2695: before 1.20rc119; 1.20rc119-beta31 — fixed in 1.20rc119
Dlink Dap-3320 Firmware: before 1.05rc027; 1.05rc027-beta — fixed in 1.05rc027
Dlink Dap-3662 Firmware: through 1.05rc047

How to fix

Upgrade to a fixed version: D-Link DAP-2695 1.20rc119; Dlink Dap-3320 Firmware 1.05rc027. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-38873 or the next vulnerability affects your stack