CVE-2021-39510
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router, The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
Se ha descubierto un problema en el router inalámbrico D-Link DIR816_A1_FW101CNB04 750m11ac, El parámetro de solicitud HTTP se utiliza en la función de manejador de la ruta /goform/form2userconfig.cgi, que puede construir la cadena de nombre de usuario para eliminar la función de usuario. Esto puede conducir a la inyección de comandos a través de metacaracteres del shell
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-08-23 CVE Reserved
- 2021-08-24 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-08-27 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://github.com/doudoudedi/main-DIR-816_A1_Command-injection | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/doudoudedi/main-DIR-816_A1_Command-injection/blob/main/injection_A1.md | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.dlink.com/en/security-bulletin | 2021-09-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Dlink Search vendor "Dlink" | Dir-816 Firmware Search vendor "Dlink" for product "Dir-816 Firmware" | 101cnb04 Search vendor "Dlink" for product "Dir-816 Firmware" and version "101cnb04" | - |
Affected
| in | Dlink Search vendor "Dlink" | Dir-816 Search vendor "Dlink" for product "Dir-816" | a1 Search vendor "Dlink" for product "Dir-816" and version "a1" | - |
Safe
|