CVE-2022-28958: Remote Code Execution Vulnerability in D-Link REJECTED | Grey Noise Blog

Summary: CVE-2022-28958 was reported as a remote code execution flaw in D-Link DIR816L_FW206b01 firmware via the value parameter at shareport.php, but testing across firmware versions including the reportedly vulnerable 2.06b1 found no evidence of the vulnerability, and the original researcher provided no supporting evidence. The CVE was marked REJECTED by the CVE List, retracted by the Certified Naming Authority that published it, removed by CISA from its known exploited vulnerabilities catalog, and GreyNoise pulled its D-Link DIR-816 tag for the CVE.
Bottom line: A CVE that reached CISA's known exploited vulnerabilities catalog turned out to describe a vulnerability that did not exist, and the retraction only came after testing and review by multiple parties. Every hour a team spends chasing a phantom CVE is an hour not spent on the threats that are real.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-28958
Related: Mirai Variant Moo Bot Targeting D-Link Devices Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026