CVE-2021-45382 D-Link Multiple Routers Remote Code Execution
Attackers can execute arbitrary commands on vulnerable D-Link routers via the DDNS function, but no patch is available as the devices are end-of-life.
- Exploited in the wild
- Since 4 Apr 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-45382?
CVE-2021-45382 is a critical command injection vulnerability in n/a, published on 17 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
Weakness: CWE-78
Which versions are affected by CVE-2021-45382?
It affects 6 products.
Products include Dlink Dir-810l Firmware, Dlink Dir-820l Firmware, Dlink Dir-820lw Firmware, Dlink Dir-826l Firmware, Dlink Dir-830l Firmware, Dlink Dir-836l Firmware.
How do I fix CVE-2021-45382?
No fix has been published for CVE-2021-45382 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Apr 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-45382 being exploited?
Yes. Attackers have exploited CVE-2021-45382 in the wild since at least 4 Apr 2022.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5wgx-qvpv-2353.