Buffer Overflow Vulnerability in D-Link DAP-2020 Routers

CVE-2021-34862

Summary

This security flaw in D-Link DAP-2020 routers allows network-adjacent attackers to execute arbitrary code without authentication. The issue arises from inadequate validation of the var:menu parameter in the webproc endpoint. This leads to a buffer overflow due to user-supplied data being copied into a fixed-length stack-based buffer, enabling threats to run code at root level, compromising the device's security.

References