CVE-2022-36785

D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15 "login.asp" A. The window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ; "admin" – contains default username value "login.asp" B. While accessing the web interface, the login form at *Authorization Bypass – URL by "setupWizard.asp' while it blocks direct access to – the web interface does not properly validate user identity variables values located at the client side, it is available to access it without a "login_glag" and "login_status" checking browser and to read the admin user credentials for the web interface.

• CWE-863
• CWE-863

• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory
• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory

Published

Nov 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3678Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36780Avdor CIS - crystal quality Credentials Management Errors. T…5.3
• CVE-2022-36781ConnectWise ScreenConnect versions 22.6 and below contained …5.3
• CVE-2022-36782Pal Electronics Systems - Pal Gate Authorization Errors. The…8.6
• CVE-2022-36783AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A m…5.4
• CVE-2022-36784 Elsight – Elsight Halo  Remote Code Execution (RCE) Elsight…9.8
• CVE-2022-36786DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 ha…9.9
• CVE-2022-36787 webvendome - webvendome SQL Injection. SQL Injection in the…9.8
• CVE-2022-36788A heap-based buffer overflow vulnerability exists in the Tri…7.8
• CVE-2022-36789Improper access control in BIOS firmware for some Intel(R) N…7.8
• CVE-2022-3679The Starter Templates by Kadence WP WordPress plugin before …8.8
• CVE-2022-36791Authenticated (contributor+) Stored Cross-Site Scripting (XS…5.4