cyfenced.com →

[ CVE-2021-45382 · Published 17 Feb 2022 ]

D-Link Multiple Routers Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 98%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-04
  • EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

CISA: A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Apr 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References