--- title: "D-Link DNR-322L CVE-2022-40799: EOL NVR RCE in KEV" url: https://erroneo.us/security/briefs/d-link-dnr-322l-cve-2022-40799-backup-restore-rce/ description: "An authenticated root RCE via config restore in the end-of-life D-Link DNR-322L NVR has no fix and joined CISA KEV in August 2025. Find and replace any left." type: security-brief section: "Security Digest" date_published: 2022-09-27 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2022-40799"] severity: "high" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # D-Link DNR-322L CVE-2022-40799: EOL NVR RCE in KEV **Verdict: Check exposure.** There is no patch and never will be; the job is to find any DNR-322L recorder still plugged in and replace it, not to fix it. - **Who must act:** Anyone with a D-Link DNR-322L network video recorder still in service, especially one whose web interface is reachable from the internet or uses a default or shared password. - **Who can relax:** Organizations with no DNR-322L units; the flaw is specific to this discontinued recorder. - **Affected:** D-Link DNR-322L, all hardware revisions, firmware 2.60B15 and earlier (D-Link lists v2.40, v2.60B13 and v2.60B15 hotfix betas) - **Fixed:** None. D-Link lists the fixed firmware as Not Available; the product reached end of service on November 30, 2021 - **CVEs:** CVE-2022-40799 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory video recorders and NAS boxes in offices, shops and branch sites and flag any D-Link DNR-322L. 2. Replace every DNR-322L with a supported recorder; D-Link will not release a fix. 3. Until it is replaced, keep the web interface off the internet and reachable only from a management host. 4. Change the admin password to a strong unique one and remove any extra user accounts. 5. Move cameras and the recorder onto an isolated network segment with no route to office systems. ### How to check if you are affected - Download a configuration backup and read rc.init.sh for lines you did not add, such as utelnetd or openssl s_client. - Scan the recorder for an open telnet port (23/tcp), which is not part of normal use. - Review firewall logs for outbound connections from the recorder to unfamiliar addresses. ## What happened The D-Link DNR-322L is a small two-bay network video recorder that stores footage from up to 16 IP cameras. In 2022 a researcher [found](https://mkiesel.ch/posts/dlink-dnr322/) a short path to root. The "Backup Config" feature under Maintenance, System, Configuration Settings exports a plain gzip tarball. Inside is `rc.init.sh`, a shell script the device runs at boot. The recorder does not check the integrity of a backup when it is restored. Anyone who can log in can download the backup, append commands to that script, upload it and wait for the reboot. The researcher used this to start a telnet daemon with a root shell. The [proof-of-concept script](https://gitlab.com/rtfmkiesel/cve-2022-40799) automates the whole chain. D-Link replied within hours of the researcher's September 12, 2022 email. Its advisory [SAP10305](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10305) confirms the bug in v2.40 and the v2.60B13 and v2.60B15 hotfix betas, lists the fixed firmware as "Not Available," and says all hardware revisions reached end of service on November 30, 2021. The write-up and exploit went public on September 27, 2022, and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-40799) on November 29. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-40799) scores it CVSS 3.1 8.8, with low privileges required. On August 5, 2025, CISA [added](https://www.cisa.gov/news-events/alerts/2025/08/05/cisa-adds-three-known-exploited-vulnerabilities-catalog) the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40799) "based on evidence of active exploitation," together with two D-Link DCS-2530L and DCS-2670L camera bugs. Federal agencies had until August 26, 2025, and the listing tells users to discontinue the product. ## Who is affected Every DNR-322L on firmware 2.60B15 or earlier, which D-Link's advisory treats as all firmware for all hardware revisions. D-Link's [UK product page](https://www.dlink.com/uk/en/products/dnr-322l-cloud-network-video-recorder) says the model was phased out on September 19, 2021. D-Link's advice is to "retire and replace this unit regardless." Other D-Link recorders are not named in this CVE. ## Do you really need to act? Only if you still have one, and then the answer is replacement, not patching. CISA did not say who is exploiting the bug or how. [The Hacker News](https://thehackernews.com/2025/08/cisa-adds-3-d-link-router-flaws-to-kev.html) reported "no details on how these shortcomings are being exploited in the wild." It linked the camera bugs to an FBI warning about HiatusRAT scanning, but not this recorder. We found no public report tying CVE-2022-40799 to a named campaign as of October 23, 2026. The bug needs a valid login, which limits it. That barrier is thin if the admin password is weak or unchanged, and a public exploit has existed since 2022. A compromised recorder is a root Linux box on your network with access to camera feeds. Corporate exposure is small; the realistic risk is a forgotten unit in a shop, branch office or client site. ## What to do now 1. Search your asset lists and network scans for DNR-322L units, including ones installed by security or facilities contractors. 2. Replace each one with a supported recorder. There is no firmware to install. 3. Until then, block internet access to its web interface and allow management only from one admin host. 4. Set a strong, unique admin password and delete any other accounts. 5. Put the recorder and cameras on their own segment, then run `nmap -Pn -p 23,80,443 ` from an office host to confirm nothing answers. ## How to tell if you were hit Take a configuration backup from the web interface and unpack it with `tar -xzf backup`. Read `rc.init.sh`. Lines you did not add, such as `utelnetd` or `openssl s_client`, mean someone used this bug. An open telnet port, unknown accounts, or outbound connections from the recorder to unfamiliar addresses are also warning signs. If anything looks wrong, disconnect and replace the unit. ## Timeline - Nov 30, 2021 — DNR-322L reaches end of service, per D-Link. - Sep 12, 2022 — Researcher emails D-Link security; D-Link replies the same day. - Sep 27, 2022 — CVE reserved; write-up and exploit published; D-Link's SAP10305 last updated. - Nov 29, 2022 — CVE-2022-40799 published. - Aug 5, 2025 — CISA adds the CVE to KEV. - Aug 26, 2025 — Federal remediation deadline. ## Sources 1. [D-Link — SAP10305: DNR-322L End of Life / End of Service Life Authenticated RCE vulnerability](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10305) 2. [D-Link UK — DNR-322L mydlink-enabled Network Video Recorder](https://www.dlink.com/uk/en/products/dnr-322l-cloud-network-video-recorder) 3. [mkiesel.ch — D-Link DNR-322L: Authenticated RCE (CVE-2022-40799)](https://mkiesel.ch/posts/dlink-dnr322/) 4. [GitLab — CVE-2022-40799 proof of concept and README](https://gitlab.com/rtfmkiesel/cve-2022-40799) 5. [CVE record — CVE-2022-40799](https://www.cve.org/CVERecord?id=CVE-2022-40799) 6. [NVD — CVE-2022-40799](https://nvd.nist.gov/vuln/detail/CVE-2022-40799) 7. [CISA — Known Exploited Vulnerabilities: CVE-2022-40799](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40799) 8. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug 5, 2025)](https://www.cisa.gov/news-events/alerts/2025/08/05/cisa-adds-three-known-exploited-vulnerabilities-catalog) 9. [The Hacker News — CISA adds three D-Link camera and video recorder flaws to KEV (Aug 6, 2025)](https://thehackernews.com/2025/08/cisa-adds-3-d-link-router-flaws-to-kev.html) --- Source page: https://erroneo.us/security/briefs/d-link-dnr-322l-cve-2022-40799-backup-restore-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt