CVE-2021-29296 Null dereference in n/a

High 7.5 Published 10 Aug 2021 Updated 3 Aug 2024

Remote attackers can cause a denial of service on D-Link DIR-825 routers by sending a specific HTTP request, triggering a null pointer dereference.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-29296?

CVE-2021-29296 is a high-severity vulnerability in n/a, published on 10 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vct_wan; the sbin/httpd would invoke the strchr function and take NULL as a first argument, which finally leads to the segmentation fault. NOTE: The DIR-825 and all hardware revisions is considered End of Life and as such this issue will not be patched

Weakness: CWE-476

Which versions are affected by CVE-2021-29296?

It affects 1 product.

Products include Dlink Dir-825 Firmware.

How do I fix CVE-2021-29296?

No fix has been published for CVE-2021-29296 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-29296 being exploited?

There is no known exploitation of CVE-2021-29296 in the wild and no public exploit code.

Sources

Also known as GHSA-4gp5-h62v-pf2f.