Sign-up

ID

VAR-202104-1035


CVE

CVE-2021-27249


TITLE

D-Link DAP-2020 WEB_CmdFileList Command Injection Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-21-204

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11369. D-Link DAP-2020 is a WiFi range extender from D-Link in Taiwan. TCP (Transmission Control Protocol, Transmission Control Protocol) is a connection-oriented, reliable, byte stream-based transport layer communication protocol, defined by IETF RFC 793. The vulnerability stems from the program's failure to correctly verify the string provided by the user before executing the system call

Trust: 2.16

sources: NVD: CVE-2021-27249 // ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // VULMON: CVE-2021-27249

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

category:['network device']sub_category:access point

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2021-40325

AFFECTED PRODUCTS

vendor:dlinkmodel:dap-2020scope:eqversion:1.01

Trust: 1.0

vendor:d linkmodel:dap-2020scope: - version: -

Trust: 0.7

vendor:d linkmodel:dap-2020 v1.01rc001scope: - version: -

Trust: 0.6

sources: ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // NVD: CVE-2021-27249

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-27249
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2021-27249
value: HIGH

Trust: 1.0

ZDI: CVE-2021-27249
value: HIGH

Trust: 0.7

CNVD: CNVD-2021-40325
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-1141
value: HIGH

Trust: 0.6

VULMON: CVE-2021-27249
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-27249
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2021-40325
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-27249
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2021-27249
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.0

ZDI: CVE-2021-27249
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // VULMON: CVE-2021-27249 // CNNVD: CNNVD-202104-1141 // NVD: CVE-2021-27249 // NVD: CVE-2021-27249

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

sources: NVD: CVE-2021-27249

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202104-1141

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202104-1141

PATCH

title:D-Link has issued an update to correct this vulnerability.url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201

Trust: 0.7

title:Patch for D-Link DAP-2020 command injection vulnerability (CNVD-2021-40325)url:https://www.cnvd.org.cn/patchInfo/show/270741

Trust: 0.6

title:D-Link DAP-2020 Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=147624

Trust: 0.6

title:https://github.com/Alonzozzz/alonzzzourl:https://github.com/Alonzozzz/alonzzzo

Trust: 0.1

title:Vulnerabilityurl:https://github.com/tzwlhack/Vulnerability

Trust: 0.1

title:SecBooks SecBooks目录url:https://github.com/SexyBeast233/SecBooks

Trust: 0.1

sources: ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // VULMON: CVE-2021-27249 // CNNVD: CNNVD-202104-1141

EXTERNAL IDS

db:NVDid:CVE-2021-27249

Trust: 3.1

db:ZDIid:ZDI-21-204

Trust: 2.4

db:DLINKid:SAP10201

Trust: 1.7

db:ZDI_CANid:ZDI-CAN-11369

Trust: 0.7

db:CNVDid:CNVD-2021-40325

Trust: 0.6

db:CS-HELPid:SB2021100105

Trust: 0.6

db:CNNVDid:CNNVD-202104-1141

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

db:VULMONid:CVE-2021-27249

Trust: 0.1

sources: OTHER: None // ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // VULMON: CVE-2021-27249 // CNNVD: CNNVD-202104-1141 // NVD: CVE-2021-27249

REFERENCES

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10201

Trust: 2.4

url:https://www.zerodayinitiative.com/advisories/zdi-21-204/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-27249

Trust: 1.2

url:https://www.cybersecurity-help.cz/vdb/sb2021100105

Trust: 0.6

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alonzozzz/alonzzzo

Trust: 0.1

sources: OTHER: None // ZDI: ZDI-21-204 // CNVD: CNVD-2021-40325 // VULMON: CVE-2021-27249 // CNNVD: CNNVD-202104-1141 // NVD: CVE-2021-27249

CREDITS

Anthony Schneiter & Jannis Kirschner from Team SUID (in alphabetical order)

Trust: 0.7

sources: ZDI: ZDI-21-204

SOURCES

db:OTHERid: -
db:ZDIid:ZDI-21-204
db:CNVDid:CNVD-2021-40325
db:VULMONid:CVE-2021-27249
db:CNNVDid:CNNVD-202104-1141
db:NVDid:CVE-2021-27249

LAST UPDATE DATE

2025-01-30T21:50:19.053000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-204date:2021-02-24T00:00:00
db:CNVDid:CNVD-2021-40325date:2021-06-08T00:00:00
db:VULMONid:CVE-2021-27249date:2023-11-08T00:00:00
db:CNNVDid:CNNVD-202104-1141date:2021-10-08T00:00:00
db:NVDid:CVE-2021-27249date:2024-11-21T05:57:41.050

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-204date:2021-02-24T00:00:00
db:CNVDid:CNVD-2021-40325date:2021-06-08T00:00:00
db:VULMONid:CVE-2021-27249date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202104-1141date:2021-04-14T00:00:00
db:NVDid:CVE-2021-27249date:2021-04-14T16:15:13.453