CVE-2021-28839 Null dereference in n/a

High 7.5 Published 10 Aug 2021 Updated 3 Aug 2024

A null pointer dereference in D-Link access points allows remote attackers to cause a denial of service via a specific HTTP GET request.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28839?

CVE-2021-28839 is a high-severity vulnerability in n/a, published on 10 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.

Weakness: CWE-476

Which versions are affected by CVE-2021-28839?

It affects 9 products.

Products include Dlink Dap-2310 Firmware, Dlink Dap-2330 Firmware, Dlink Dap-2360 Firmware, Dlink Dap-2553 Firmware, Dlink Dap-2660 Firmware, Dlink Dap-2690 Firmware and 3 more.

How do I fix CVE-2021-28839?

No fix has been published for CVE-2021-28839 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-28839 being exploited?

There is no known exploitation of CVE-2021-28839 in the wild and no public exploit code.

Sources

Also known as GHSA-rrv2-hvjc-wxqv.