PT-2021-17144 · D Link · D-Link Dir-816 A2

Published 2021-03-30 · Updated 2022-07-12 · CVE-2021-26810

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: D-link DIR-816 A2 version 1.10

Description: The issue is related to a remote code injection vulnerability. It involves the use of an HTTP request parameter in command string construction within the handler function of the "/goform/dir setWanWifi" endpoint. This can lead to command injection via shell metacharacters in the statuscheckpppoeuser parameter.

Recommendations: For D-link DIR-816 A2 version 1.10, as a temporary workaround, consider restricting access to the "/goform/dir setWanWifi" endpoint to minimize the risk of exploitation. Avoid using the statuscheckpppoeuser parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-26810

Affected Products

D-Link Dir-816 A2

References · 5

• 🔥❌ https://github.com/GD008/vuln/blob/main/DIR-816.md · Exploit, Deleted
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26810 · Security Note
• https://t.me/cvenotify/12747 · Telegram Post