Remote Code Execution Vulnerability in D-Link Wi-Fi Access Point
CVE-2021-27249

8.8HIGH

Key Information:

Vendor
D-link
Status
Dap-2020
Vendor
CVE Published:
14 April 2021

Summary

A flaw in the processing of CGI scripts in the D-Link DAP-2020 v1.01rc001 Wi-Fi access point allows network-adjacent attackers to execute arbitrary code. The vulnerability arises from inadequate validation of user-supplied strings, enabling unauthorized code execution with root privileges. This exploitation does not require authentication, making it particularly concerning. For further details, refer to D-Link's support announcement and Zero Day Initiative's advisory.

Affected Version(s)

DAP-2020 v1.01rc001

References

https://supportannouncement.us.dlink.com/announcement/pub...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-204/
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthony Schneiter & Jannis Kirschner from Team SUID (in alphabetical order)
.