PT-2022-2439 · D Link · D-Link Dir-825Ac G1
Published
2022-01-20
·
Updated
2022-05-07
·
CVE-2021-46442
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
D-Link DIR-825 G1
Description
The issue is related to the "webupg" binary, where attackers can bypass authentication through the
autoupgrade.asp parameter. This allows them to perform unauthorized actions, such as downloading configuration files and updating firmware. The vulnerability is associated with weaknesses in authentication when handling the autoupgrade.asp parameter, which can be exploited using a specially crafted POST request.Recommendations
For D-Link DIR-825 G1, as a temporary workaround, consider restricting access to the
autoupgrade.asp parameter to minimize the risk of exploitation. Avoid using the autoupgrade.asp parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
D-Link Dir-825Ac G1