D-Link DNR-322L CVE-2022-40799: EOL NVR RCE in KEV

What to do

1. Inventory video recorders and NAS boxes in offices, shops and branch sites and flag any D-Link DNR-322L.
2. Replace every DNR-322L with a supported recorder; D-Link will not release a fix.
3. Until it is replaced, keep the web interface off the internet and reachable only from a management host.
4. Change the admin password to a strong unique one and remove any extra user accounts.
5. Move cameras and the recorder onto an isolated network segment with no route to office systems.

How to check if you are affected or compromised

• Download a configuration backup and read rc.init.sh for lines you did not add, such as utelnetd or openssl s_client.
• Scan the recorder for an open telnet port (23/tcp), which is not part of normal use.
• Review firewall logs for outbound connections from the recorder to unfamiliar addresses.

What happened#

The D-Link DNR-322L is a small two-bay network video recorder that stores footage from up to 16 IP cameras. In 2022 a researcher found a short path to root. The "Backup Config" feature under Maintenance, System, Configuration Settings exports a plain gzip tarball. Inside is rc.init.sh, a shell script the device runs at boot. The recorder does not check the integrity of a backup when it is restored. Anyone who can log in can download the backup, append commands to that script, upload it and wait for the reboot. The researcher used this to start a telnet daemon with a root shell. The proof-of-concept script automates the whole chain.

D-Link replied within hours of the researcher's September 12, 2022 email. Its advisory SAP10305 confirms the bug in v2.40 and the v2.60B13 and v2.60B15 hotfix betas, lists the fixed firmware as "Not Available," and says all hardware revisions reached end of service on November 30, 2021. The write-up and exploit went public on September 27, 2022, and the CVE record on November 29. NVD scores it CVSS 3.1 8.8, with low privileges required.

On August 5, 2025, CISA added the CVE to its KEV catalog "based on evidence of active exploitation," together with two D-Link DCS-2530L and DCS-2670L camera bugs. Federal agencies had until August 26, 2025, and the listing tells users to discontinue the product.

Who is affected#

Every DNR-322L on firmware 2.60B15 or earlier, which D-Link's advisory treats as all firmware for all hardware revisions. D-Link's UK product page says the model was phased out on September 19, 2021. D-Link's advice is to "retire and replace this unit regardless." Other D-Link recorders are not named in this CVE.

Do you really need to act?#

Only if you still have one, and then the answer is replacement, not patching. CISA did not say who is exploiting the bug or how. The Hacker News reported "no details on how these shortcomings are being exploited in the wild." It linked the camera bugs to an FBI warning about HiatusRAT scanning, but not this recorder. We found no public report tying CVE-2022-40799 to a named campaign as of October 23, 2026.

The bug needs a valid login, which limits it. That barrier is thin if the admin password is weak or unchanged, and a public exploit has existed since 2022. A compromised recorder is a root Linux box on your network with access to camera feeds. Corporate exposure is small; the realistic risk is a forgotten unit in a shop, branch office or client site.

What to do now#

1. Search your asset lists and network scans for DNR-322L units, including ones installed by security or facilities contractors.
2. Replace each one with a supported recorder. There is no firmware to install.
3. Until then, block internet access to its web interface and allow management only from one admin host.
4. Set a strong, unique admin password and delete any other accounts.
5. Put the recorder and cameras on their own segment, then run nmap -Pn -p 23,80,443 <camera-subnet> from an office host to confirm nothing answers.

How to tell if you were hit#

Take a configuration backup from the web interface and unpack it with tar -xzf backup. Read rc.init.sh. Lines you did not add, such as utelnetd or openssl s_client, mean someone used this bug. An open telnet port, unknown accounts, or outbound connections from the recorder to unfamiliar addresses are also warning signs. If anything looks wrong, disconnect and replace the unit.

Timeline#

• Nov 30, 2021 — DNR-322L reaches end of service, per D-Link.
• Sep 12, 2022 — Researcher emails D-Link security; D-Link replies the same day.
• Sep 27, 2022 — CVE reserved; write-up and exploit published; D-Link's SAP10305 last updated.
• Nov 29, 2022 — CVE-2022-40799 published.
• Aug 5, 2025 — CISA adds the CVE to KEV.
• Aug 26, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2022-40799 · KEV 2025-08-05 · Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. D-Link — SAP10305: DNR-322L End of Life / End of Service Life Authenticated RCE vulnerability supportannouncement.us.dlink.com
2. D-Link UK — DNR-322L mydlink-enabled Network Video Recorder dlink.com
3. mkiesel.ch — D-Link DNR-322L: Authenticated RCE (CVE-2022-40799) mkiesel.ch
4. GitLab — CVE-2022-40799 proof of concept and README gitlab.com
5. CVE record — CVE-2022-40799 cve.org
6. NVD — CVE-2022-40799 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2022-40799 cisa.gov
8. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug 5, 2025) cisa.gov

Coverage and analysis

1. The Hacker News — CISA adds three D-Link camera and video recorder flaws to KEV (Aug 6, 2025) thehackernews.com