Read the docs
TI-2022-18335 Aliases CVE-2022-38873GHSA-j3gx-wf89-g4rx

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360…

Priority HIGH 72CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-345.

Summary

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dap-2310_firmware:*:*:*:*:*:*:*:*up to 2.10rc036VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2310:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2330_firmware:*:*:*:*:*:*:*:*up to 1.06rc020VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2330:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2360_firmware:*:*:*:*:*:*:*:*up to 2.10rc050VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2360:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2553_firmware:*:*:*:*:*:*:*:*up to 3.10rc031VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2553:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2660_firmware:*:*:*:*:*:*:*:*up to 1.15rc093VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2660:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2310_firmware:*:*:*:*:*:*:*:* Versions up to 2.10rc036 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2330_firmware:*:*:*:*:*:*:*:* Versions up to 1.06rc020 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2360_firmware:*:*:*:*:*:*:*:* Versions up to 2.10rc050 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2360:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2553_firmware:*:*:*:*:*:*:*:* Versions up to 3.10rc031 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2553:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2660_firmware:*:*:*:*:*:*:*:* Versions up to 1.15rc093 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2660:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dlink:dap-2690_firmware:*:*:*:*:*:*:*:*up to 3.20rc106VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2690:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2695_firmware:*:*:*:*:*:*:*:*before 1.20rc119VulnerableD-Link Japan K.K.
cpe:2.3:o:dlink:dap-2695_firmware:1.20rc119:beta31:*:*:*:*:*:*1.20rc119 beta31VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-2695:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-3320_firmware:*:*:*:*:*:*:*:*before 1.05rc027VulnerableD-Link Japan K.K.
cpe:2.3:o:dlink:dap-3320_firmware:1.05rc027:beta:*:*:*:*:*:*1.05rc027 betaVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-3320:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
cpe:2.3:o:dlink:dap-3662_firmware:*:*:*:*:*:*:*:*up to 1.05rc047VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dap-3662:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2690_firmware:*:*:*:*:*:*:*:* Versions up to 3.20rc106 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2695_firmware:*:*:*:*:*:*:*:* Versions before 1.20rc119 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-2695_firmware:1.20rc119:beta31:*:*:*:*:*:* Versions 1.20rc119 beta31 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-2695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-3320_firmware:*:*:*:*:*:*:*:* Versions before 1.05rc027 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-3320_firmware:1.05rc027:beta:*:*:*:*:*:* Versions 1.05rc027 beta Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-3320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dap-3662_firmware:*:*:*:*:*:*:*:* Versions up to 1.05rc047 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dap-3662:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38873
  2. 2026-10-03 Alias added: GHSA-j3gx-wf89-g4rx

References

Exploit 1

Advisory 1

  • TI-2016-01419 Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360… CVSS 3.0CRITICAL 9.8
  • TI-2021-09829 Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330… CVSS 3.1HIGH 7.5
  • TI-2021-09827 Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036… CVSS 3.1HIGH 7.5
  • TI-2021-09828 Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences