CVE-2022-40799

What it actually does

The flaw permits an authenticated network user to inject operating-system commands through the vulnerable D-Link DNR-322L backup-configuration functionality in firmware versions up to and including 2.60B15. Because the web interface processes attacker-controlled input unsafely, commands may execute with the privileges of the device-side service, enabling modification of configuration, retrieval of sensitive recordings or credentials, installation of malware, persistence, lateral movement, or denial of service. The CVSS 8.8 rating reflects low-complexity network exploitation requiring valid credentials but no user interaction, with high confidentiality, integrity, and availability impact.

Why it matters to the business

Compromise of a network video recorder can disrupt physical security monitoring, expose surveillance footage, provide attackers a foothold inside the network, and allow the device to be used for botnet activity, proxying, or further attacks. This issue is listed in CISA KEV with a remediation due date of 2025-08-26, indicating confirmed exploitation in the wild and a need for expedited remediation. The supplied product metadata also references DisCatSharp fixed in 9.9.1; because that does not align with the D-Link appliance description, asset owners should verify affected-product mapping before relying on package-only remediation data.

How an attack unfolds

An attacker first obtains credentials for the D-Link DNR-322L management interface, commonly through default credentials, reused passwords, exposed administrative services, or prior compromise. After authenticating to the web interface, the attacker accesses the backup-configuration workflow and submits crafted input containing shell metacharacters or command payloads. The vulnerable firmware fails to preserve data integrity and safely constrain that input, causing the device to execute attacker-supplied operating-system commands. The attacker may then run reconnaissance commands, dump configuration and credentials, retrieve or delete video data, download a payload using embedded Linux utilities such as wget or curl, change permissions with chmod, launch a reverse shell, enable persistence, or use the device as an internal pivot. Active exploitation has been observed in the wild under the KEV entry for D-Link DNR-322L download/code integrity abuse, so defenders should assume internet-exposed or weakly protected devices are at elevated risk.

How to fix it

Upgrade affected D-Link DNR-322L devices running firmware 2.60B15 or earlier to a vendor-provided fixed firmware version if available, or replace/end-of-life the device if no supported firmware is available. Restrict access to the management interface to trusted administrative networks or VPNs only, disable internet exposure, enforce strong unique credentials, and remove default accounts. If a software inventory reports DisCatSharp as affected, upgrade DisCatSharp to version 9.9.1 or later as supplied in the input metadata, but validate that this package finding is not being conflated with the D-Link appliance vulnerability. Where immediate firmware remediation is not possible, place the device behind firewall rules, block inbound management access from untrusted networks, monitor administrative activity, and consider isolating the recorder on a dedicated VLAN with no unnecessary outbound internet access.

How to confirm the fix worked

Confirm all D-Link DNR-322L assets are inventoried and check firmware versions through the administrative interface or device management records; any device at or below 2.60B15 should be treated as exposed until remediated or isolated. Verify that the management interface is not reachable from the internet or untrusted segments using external scanning and internal network validation. After patching or replacement, retest that the backup-configuration workflow no longer executes shell metacharacters or command payloads, and confirm that administrative logs show only expected users and source addresses. If DisCatSharp is in scope for the environment, confirm package version 9.9.1 or later in dependency manifests and deployed artifacts.

Typical attack path

1. Identify an exposed or reachable D-Link DNR-322L management interface.
2. Authenticate using stolen, reused, default, or previously compromised credentials.
3. Navigate to the backup-configuration function.
4. Submit crafted backup/configuration input containing OS command separators or shell syntax.
5. Cause the device web service to execute arbitrary commands on the underlying operating system.
6. Run discovery commands and extract configuration, credentials, recordings, or network information.
7. Download and execute additional tooling or malware from an external host.
8. Establish persistence, proxy traffic, disrupt recording services, or pivot to other internal systems.

How to detect it

To determine whether exploitation already occurred, review device web-management logs, syslog output, firewall logs, VPN/authentication logs, DNS logs, proxy logs, and network flow records for suspicious authenticated access to the backup-configuration function followed by command-like payloads or unusual outbound traffic. Focus on logins from unfamiliar source IPs, access outside maintenance windows, repeated failed and successful logins, HTTP parameters containing shell metacharacters, and requests that include downloader or execution utilities such as wget, curl, tftp, busybox, sh, chmod, or nc. On the device, if shell access or forensic acquisition is possible, inspect running processes, crontab/startup scripts, writable temporary directories, recently modified files, unknown binaries, unexpected listening ports, altered configuration files, and shell history if present. Network evidence may be stronger than host evidence because embedded appliances often have limited logging. Given the KEV listing and active exploitation, absence of logs should not be considered proof of non-compromise if the device was internet-exposed or used weak credentials.

• ;wget
• ;curl
• |wget
• |curl
• `wget
• `curl
• $(wget
• $(curl
• busybox wget
• busybox nc
• chmod +x /tmp/
• /bin/sh -c
• sh -c wget
• sh -c curl
• nc -e /bin/sh
• /tmp/.
• /var/tmp/.
• tftp -g
• POST /cgi-bin/
• GET /cgi-bin/
• backup config
• Backup Config

What your security team should do

• Treat this as urgent because it is in CISA KEV and has active exploitation in the wild; prioritize internet-exposed or remotely accessible D-Link DNR-322L devices first.
• Immediately remove public access to D-Link DNR-322L management interfaces and restrict administration to trusted networks or VPNs.
• Upgrade affected D-Link DNR-322L firmware where a supported fix exists; otherwise plan rapid device replacement or permanent isolation.
• Rotate credentials for the device and any accounts reused elsewhere, especially if suspicious administrative activity is found.
• Review web, syslog, firewall, DNS, and outbound proxy logs for command-injection payloads, unexpected downloads, reverse shells, or unusual outbound connections from the recorder.
• Hunt for embedded Linux malware behaviors on the device, including unexpected processes, files in temporary directories, modified startup scripts, and outbound connections to unknown infrastructure.
• Validate the apparent DisCatSharp 9.9.1 fixed-version metadata separately to avoid remediating the wrong technology stack.
• Add monitoring for future access to backup/export/configuration functions and alert on shell metacharacters or downloader utilities in HTTP requests.