CVE-2021-20134

Severity Score

8.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion.

Los servicios Quagga en D-Link DIR-2640 menores o iguales a la versión 1.11B02, están afectados por una vulnerabilidad de salto de ruta absoluto que permite a un atacante remoto y autenticado establecer un archivo arbitrario en el sistema de archivos del router como el archivo de registro usado por cualquiera de los servicios Quagga (zebra o ripd). Los mensajes de registro subsiguientes serán añadidos al archivo, precedidos por una marca de tiempo y algunos metadatos de registro. Una ejecución de código remota puede lograrse usando esta vulnerabilidad para anexar a un script de shell en el sistema de archivos del router, y luego esperar o desencadenar la ejecución de ese script. De este modo, puede obtenerse fácilmente un shell remoto y no autenticado en el dispositivo.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

Medium

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-17 CVE Reserved
2021-12-30 CVE Published
2024-06-13 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://www.tenable.com/security/research/tra-2021-44	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Dlink Search vendor "Dlink"	Dir-2640-us Firmware Search vendor "Dlink" for product "Dir-2640-us Firmware"	<= 1.11b02 Search vendor "Dlink" for product "Dir-2640-us Firmware" and version " <= 1.11b02"	-	Affected	in	Dlink Search vendor "Dlink"	Dir-2640-us Search vendor "Dlink" for product "Dir-2640-us"	-	-	Safe