// For flags

CVE-2021-26709

D-Link DSL-320B-D1 Pre-Authentication Buffer Overflow

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to take over a device via the login.xgi user and pass parameters. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Los dispositivos D-Link DSL-320B-D1 versiones hasta EU_1.25, son propensos a múltiples desbordamientos de búfer en la región stack de la memoria que permiten a atacantes remotos no autenticados tomar el control de un dispositivo por medio del usuario login.xgi y parámetros pass. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son soportados por el mantenedor

The D-Link DSL-320B-D1 ADSL modem suffers from multiple pre-authentication stack buffer overflow vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-02-05 CVE Reserved
  • 2021-04-07 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-08-10 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-787: Out-of-bounds Write
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
D-link
Search vendor "D-link"
 Dsl-320b-d1
Search vendor "D-link" for product "Dsl-320b-d1"
 <= eu_1.25
Search vendor "D-link" for product "Dsl-320b-d1" and version " <= eu_1.25"
-
Affected
in D-link
Search vendor "D-link"
 Dsl-320b-d1
Search vendor "D-link" for product "Dsl-320b-d1"
--
Safe
* End Of Life in some or all products. Do not expect updates.