PT-2022-1646 · D Link · D-Link Dir-830L+4

Huanbin Ruan · Published 2022-02-17 · Updated 2025-11-10 · CVE-2021-45382

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-link DIR-810L versions all D-link DIR-820L/LW versions all D-link DIR-826L versions all D-link DIR-830L versions all D-link DIR-836L versions all

Description A Remote Command Execution vulnerability exists in the DDNS function of the affected routers, allowing a remote attacker to execute arbitrary commands. The issue is related to insufficient checking of arguments passed to a command. The affected routers have reached their End of Life (EOL) / End of Service Life (EOS) Life-Cycle, and as such, this issue will not be patched.

Recommendations For D-link DIR-810L, consider disabling the DDNS function to minimize the risk of exploitation. For D-link DIR-820L/LW, consider disabling the DDNS function to minimize the risk of exploitation. For D-link DIR-826L, consider disabling the DDNS function to minimize the risk of exploitation. For D-link DIR-830L, consider disabling the DDNS function to minimize the risk of exploitation. For D-link DIR-836L, consider disabling the DDNS function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-00895

CVE-2021-45382

Affected Products

D-Link Dir-810L

D-Link Dir-820L/Lw

D-Link Dir-826L

D-Link Dir-830L

D-Link Dir-836L

References · 17

• 🔥 https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md · Exploit
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45382 · Security Note
• https://bdu.fstec.ru/vul/2022-00895 · Security Note
• https://t.me/aptreports/5862 · Telegram Post
• https://t.me/pentestingnews/21630 · Telegram Post
• https://t.me/nekaspersky/2069 · Telegram Post
• https://t.me/cveNotify/142294 · Telegram Post
• https://t.me/cvenotify/27408 · Telegram Post
• https://t.me/aptreports/731 · Telegram Post
• https://t.me/true_secator/2804 · Telegram Post
• https://t.me/cibsecurity/37679 · Telegram Post
• https://t.me/cvenotify/26943 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45382 · Note
• https://t.me/aptreports/5860 · Telegram Post