| शीर्षक | D-Link DIR822A_101 A_101 Buffer Overflow |
|---|
| विवरण | An unauthenticated command injection vulnerability exists in the `udhcpd` DHCP service used by D-Link DIR-822 A1 firmware. While processing a `DHCPREQUEST` packet, the server reads the client-supplied hostname from DHCP Option 12 and concatenates it into a shell command that is executed via `system()` without sanitization.
As a result, an attacker on the local network can send a crafted DHCP packet containing shell metacharacters in the hostname field and trigger arbitrary command execution on the router. |
|---|
| स्रोत | ⚠️ https://tzh00203.notion.site/D-Link-DIR-822-A1-Command-Injection-in-udhcpd-via-DHCP-Hostname-337b5c52018a80d9b638d0fa59969e6b |
|---|
| उपयोगकर्ता | tian (UID 93438) |
|---|
| सबमिशन | 07/04/2026 01:03 PM (21 दिन पहले) |
|---|
| संयम | 26/04/2026 09:27 AM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359642 [D-Link DIR-822 A_101 udhcpd DHCP Service /udhcpcd/dhcpd.c system होस्टनाम अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|