PT-2021-17354 · D Link · D-Link Dap-2020

Chi Tran + 3 · Published 2021-02-24 · Updated 2025-12-09 · CVE-2021-27250

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001

Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The flaw exists within the processing of CGI scripts, specifically when parsing the errorpage request parameter. The process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this issue to disclose stored credentials, leading to further compromise.

Recommendations: For D-Link DAP-2020 version 1.01rc001, consider restricting access to CGI scripts until a patch is available. As a temporary workaround, avoid using the errorpage parameter in requests to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2021-27250

ZDI-21-205

Affected Products

D-Link Dap-2020

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-205 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27250 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2822 · Telegram Post
• https://twitter.com/dailycve/status/1998358128522641677 · Twitter Post