CVE-2021-21816 Information disclosure in D-LINK
An attacker can send a crafted HTTP request to the Syslog functionality to disclose sensitive information from the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-21816?
CVE-2021-21816 is a medium-severity vulnerability in D-LINK, published on 16 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2021-21816?
It affects 1 product.
Products include Dlink Dir-3040 Firmware.
How do I fix CVE-2021-21816?
No fix has been published for CVE-2021-21816 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-21816 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in D-LINK
- CVE-2021-21913 Hardcoded credentials in D-Link
- CVE-2021-21820 Hardcoded credentials in D-Link
- CVE-2022-44832 Command injection in n/a
- CVE-2021-21819 Command injection in D-Link
- CVE-2023-41229 D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability
Sources
Also known as GHSA-c5h4-7vc8-8w5m.