CVE-2021-39510 Command injection in n/a
Attackers can execute arbitrary commands on D-Link DIR816 routers via shell metacharacters in the username parameter of a specific CGI handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39510?
CVE-2021-39510 is a critical command injection vulnerability in Dlink Dir-816 Firmware, published on 24 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
Weakness: CWE-77
Which versions are affected by CVE-2021-39510?
It affects 1 product.
Products include Dlink Dir-816 Firmware.
How do I fix CVE-2021-39510?
No fix has been published for CVE-2021-39510 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-39510 being exploited?
There is no known exploitation of CVE-2021-39510 in the wild and no public exploit code.
Other vulnerabilities in Dlink Dir-816 Firmware
Sources
Also known as GHSA-wf4j-v485-5m9f.