PT-2021-17955 · D Link · D-Link Dap-2360+8

Published 2021-08-10 · Updated 2021-08-17 · CVE-2021-28839

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2310 version 2.07.RC031 D-Link DAP-2330 version 1.07.RC028 D-Link DAP-2360 version 2.07.RC043 D-Link DAP-2553 version 3.06.RC027 D-Link DAP-2660 version 1.13.RC074 D-Link DAP-2690 version 3.16.RC100 D-Link DAP-2695 version 1.17.RC063 D-Link DAP-3320 version 1.01.RC014 D-Link DAP-3662 version 1.01.RC022

Description: A Null Pointer Dereference issue exists in the upload certificate function of the sbin/httpd binary. This occurs when the binary handles a specific HTTP GET request, causing the strrchr function to take NULL as its first argument, resulting in a Null Pointer Dereference.

Recommendations: For D-Link DAP-2310 version 2.07.RC031, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2330 version 1.07.RC028, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2360 version 2.07.RC043, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2553 version 3.06.RC027, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2660 version 1.13.RC074, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2690 version 3.16.RC100, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-2695 version 1.17.RC063, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-3320 version 1.01.RC014, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available. For D-Link DAP-3662 version 1.01.RC022, consider disabling the upload certificate function in the sbin/httpd binary until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-28839

Affected Products

D-Link Dap-2310

D-Link Dap-2330

D-Link Dap-2360

D-Link Dap-2553

D-Link Dap-2660

D-Link Dap-2690

D-Link Dap-2695

D-Link Dap-3320

D-Link Dap-3662

References · 6

• 🔥 https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf · Exploit
• 🔥 https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2021-28839 · Vendor Advisory
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28839 · Security Note
• https://t.me/cvenotify/19012 · Telegram Post