PT-2021-18162 · D Link · D-Link Dsp-W215

Zyw · Published 2021-08-10 · Updated 2024-08-03 · CVE-2021-29295

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: D-Link DSP-W215 version 1.10

Description: A Null Pointer Dereference issue exists, which could allow a remote malicious user to cause a denial of service via usr/bin/lighttpd. This can be triggered by sending an HTTP request without a URL in the start line directly to the device.

Recommendations: For D-Link DSP-W215 version 1.10, consider restricting access to the device to minimize the risk of exploitation, as this issue will not be patched due to the device being End of Life. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-29295

Affected Products

D-Link Dsp-W215

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-29295 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29295 · Vendor Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10211 · Vendor Advisory
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/27108 · Telegram Post