D-Link · DNR-322L

CVE-2022-40799

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

Exploited in attacks High 8.8 Attack chance: 34%

What it is

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

CISA: D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: August 26, 2025

Added to the CISA list: August 5, 2025
Published: November 29, 2022
Severity: High 8.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 34% in the top 1.6% of all known vulnerabilities
Weakness: CWE-494
More details: NVD · CVE.org · CISA

All references (1)

https://gitlab.com/lu-ka/cve-2022-40799

More exploited flaws from D-Link

Added	Vulnerability	Product	Severity	Attack chance
Apr 24, 2026	Command InjectionCVE-2025-29635	DIR-823X	High 7.2	88%
Dec 8, 2025	Buffer OverflowCVE-2022-37055	Routers	Critical 9.8	56%
Aug 5, 2025	UnspecifiedCVE-2020-25078	DCS-2530L and DCS-2670L Devices	High 7.5	98%
Aug 5, 2025	DCS-2530L and DCS-2670L Command InjectionCVE-2020-25079	DCS-2530L and DCS-2670L Devices	High 8.8	54%
Jun 25, 2025	D-Link DIR-859 Router Path TraversalCVE-2024-0769	DIR-859 Router	Medium 5.3	83%
Sep 30, 2024	OS Command InjectionCVE-2023-25280	DIR-820 Router	Critical 9.8	98%
May 16, 2024	Information DisclosureCVE-2021-40655	DIR-605 Router	High 7.5	87%
May 16, 2024	Cross-Site Request Forgery (CSRF)CVE-2014-100005	DIR-600 Router	High 8.0	43%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.