CVE-2021-39509 Command injection in n/a
Attackers can execute arbitrary commands on D-Link DIR-816 routers via shell metacharacters in the HTTP request parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39509?
CVE-2021-39509 is a critical command injection vulnerability in Dlink Dir-816 Firmware, published on 24 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
Weakness: CWE-77
Which versions are affected by CVE-2021-39509?
It affects 1 product.
Products include Dlink Dir-816 Firmware.
How do I fix CVE-2021-39509?
No fix has been published for CVE-2021-39509 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-39509 being exploited?
There is no known exploitation of CVE-2021-39509 in the wild and no public exploit code.
Other vulnerabilities in Dlink Dir-816 Firmware
Sources
Also known as GHSA-xvjj-gv4g-2h8h.