CVE-2021-3707 Missing authorization in DSL-2750U
Unauthenticated local attackers can modify router configuration and execute OS commands on D-Link DSL-2750U devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3707?
CVE-2021-3707 is a medium-severity missing authorization vulnerability in D-Link DSL-2750U, published on 16 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the local network may exploit this, with CVE-2021-3708, to execute any OS commands on the vulnerable device.
Weakness: CWE-15
Which versions are affected by CVE-2021-3707?
It affects 1 product.
Products include Dlink Dsl-2750u Firmware.
How do I fix CVE-2021-3707?
No fix has been published for CVE-2021-3707 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-3707 being exploited?
There is no known exploitation of CVE-2021-3707 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in D-Link DSL-2750U
Sources
Also known as GHSA-q2w4-9m66-g5ff.