Digest · Tuesday

Security digest: September 27, 2022

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: D-Link DNR-322L CVE-2022-40799: EOL NVR RCE in KEV. Anyone with a D-Link DNR-322L network video recorder still in service, especially one whose web interface is reachable from the internet or uses a default or shared password.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Sep 27, 2022 · Vulnerability · CVE-2022-40799

D-Link DNR-322L CVE-2022-40799: EOL NVR RCE in KEV

There is no patch and never will be; the job is to find any DNR-322L recorder still plugged in and replace it, not to fix it.

Must act: Anyone with a D-Link DNR-322L network video recorder still in service, especially one whose web interface is reachable from the internet or uses a default or shared password.

Can relax: Organizations with no DNR-322L units; the flaw is specific to this discontinued recorder.

Inventory video recorders and NAS boxes in offices, shops and branch sites and flag any D-Link DNR-322L.
Replace every DNR-322L with a supported recorder; D-Link will not release a fix.
Until it is replaced, keep the web interface off the internet and reachable only from a management host.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.