CVE-2022-37128: dlink dir-816_firmware Improper Initialization

Vulnerability summary

CVE-2022-37128 is a critical (CVSS 9.8) Improper Initialization vulnerability in dlink dir-816_firmware. EPSS estimates a 21.71% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-08-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.

• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.