Arbitrary Code Execution in D-Link Routers

CVE-2021-34863

Summary

This vulnerability enables attackers on the same network to execute arbitrary code on D-Link DAP-2020 routers without requiring authentication. The flaw is due to inadequate validation of user-supplied data length in the var:page parameter, allowing the copying of excessively long input into a fixed-length stack buffer. An attacker can exploit this weakness to gain root-level code execution, posing significant security risks to affected installations.

References