CVE-2022-40799: D‑Link DNR‑322L Download‑Without‑Integrity‑Check Vulnerability
What It Is — The D‑Link DNR‑322L router allows an authenticated user to download and execute arbitrary code without any integrity verification. This flaw can be leveraged to run OS‑level commands on the device.
Exploitability — Publicly disclosed; no public exploit code, but the vulnerability is trivial to exploit once an attacker gains valid credentials. CVSS v3.1 base score ≈ 7.8 (High).
Affected Products — D‑Link DNR‑322L (including units that may already be End‑of‑Life or End‑of‑Service).
Why It Matters for Trust & Control Assurance
- Software‑integrity controls: The issue highlights a missing control for verifying the authenticity and integrity of firmware or code updates—an essential control that underpins many compliance regimes (e.g., NIST CSF PR.IP‑1).
- Continuous evidence: Demonstrating that update‑integrity checks are enforced and logged provides defensible audit evidence that your organization enforces a trusted‑code‑base.
- Supply‑chain diligence: Legacy or unsupported network gear can become a blind spot; maintaining an up‑to‑date inventory and evidence of de‑commissioning supports a robust supply‑chain risk posture.
Recommended Actions
- Isolate or retire any D‑Link DNR‑322L units that are EoL/EoS.
- Patch or replace devices where a vendor‑issued fix exists; otherwise, remove them from production.
- Validate firmware‑integrity controls across your network equipment: enforce signed updates, log all firmware changes, and map this control to your framework of record (e.g., NIST CSF).
- Document the remediation in your control‑evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2022‑40799