CVE-2022-38873 Denial of service in n/a

High 7.5 Published 20 Dec 2022 Updated 17 Apr 2025

Attackers can cause a denial of service on D-Link wireless access points by uploading crafted firmware with modified headers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-38873?

CVE-2022-38873 is a high-severity denial of service vulnerability in n/a, published on 20 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

Weakness: CWE-345

Which versions are affected by CVE-2022-38873?

It affects 9 products.

Products include Dlink Dap-2310 Firmware, Dlink Dap-2330 Firmware, Dlink Dap-2360 Firmware, Dlink Dap-2553 Firmware, Dlink Dap-2660 Firmware, Dlink Dap-2690 Firmware and 3 more.

How do I fix CVE-2022-38873?

No fix has been published for CVE-2022-38873 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-38873 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-38873 exists.

Sources

Also known as GHSA-j3gx-wf89-g4rx.