Debugging D-Link: Emulating firmware and hacking hardware
Summary: GreyNoise researchers took up CVE-2022-41140, a buffer overflow and remote code execution flaw in D-Link routers that D-Link was notified of on February 17th, 2022, and by November 15th, 2022 no additional information was available. They decrypted the "SHRS"-headed DIR-878 firmware, extracted prog.cgi, and used BinDiff to find that the old binary's main function used strcat() on a 512-byte buffer where the patched version did not, then emulated the service in QEMU and bought a physical DIR-867 to pursue a debugger.
Bottom line: The article's own timeline is the stake: D-Link knew about CVE-2022-41140 in February 2022, and by mid-November 2022 researchers still had nothing public to work from, so they reverse-engineered the patch themselves - meaning attackers with the same patience can find the flaw from the firmware diff alone.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-1262CVE-2022-41140CVE-2023-24762
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026