CVE-2021-28838 Null dereference in n/a

High 7.5 Published 10 Aug 2021 Updated 3 Aug 2024

A null pointer dereference in the httpd binary of various D-Link access points allows remote attackers to cause a denial of service via crafted network packets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28838?

CVE-2021-28838 is a high-severity vulnerability in n/a, published on 10 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b, DAP-2690 3.20RC115 BETA, DAP-2695 1.20RC093, DAP-3320 1.05RC027 BETA and DAP-3662 1.05rc069 in the sbin/httpd binary. The crash happens at the `atoi' operation when a specific network package are sent to the httpd binary.

Weakness: CWE-476

Which versions are affected by CVE-2021-28838?

It affects 9 products.

Products include Dlink Dap-2310 Firmware, Dlink Dap-2330 Firmware, Dlink Dap-2360 Firmware, Dlink Dap-2553 Firmware, Dlink Dap-2660 Firmware, Dlink Dap-2690 Firmware and 3 more.

How do I fix CVE-2021-28838?

No fix has been published for CVE-2021-28838 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-28838 being exploited?

There is no known exploitation of CVE-2021-28838 in the wild and no public exploit code.

Sources

Also known as GHSA-qg9w-6w4c-q3pf.