CVE-2021-45382criticalunder attackCWE-78

CVE-2021-45382

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon
Published on NVDFeb 17
CISA KEV+46d
Action required by CISAfederal deadline: 2022-04-25

The impacted product is end-of-life and should be disconnected if still in use.

In short

D-Link routers have a critical flaw in their DDNS feature that allows attackers to run malicious commands remotely without authentication. Since these router models are no longer supported, the vulnerability will never be fixed.

Technical detail

CWE-78 command injection exists in the ncc2 binary's DDNS function across multiple D-Link router models, enabling unauthenticated remote code execution via unsanitized input. The affected hardware revisions have reached end-of-life status and will not receive patches.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a