Sign-up

ID

VAR-202110-1149


CVE

CVE-2021-34860


TITLE

D-Link DAP-2020  Path Traversal Vulnerability in Routers

Trust: 0.8

sources: JVNDB: JVNDB-2021-014129

DESCRIPTION

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to the webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-12103. D-Link DAP-2020 Routers contain a path traversal vulnerability. Zero Day Initiative To this vulnerability ZDI-CAN-12103 Was numbering.Information may be obtained. D-Link DAP-2020 is a wireless N access point

Trust: 2.88

sources: NVD: CVE-2021-34860 // JVNDB: JVNDB-2021-014129 // ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // VULMON: CVE-2021-34860

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-67521

AFFECTED PRODUCTS

vendor:d linkmodel:dap-2020scope: - version: -

Trust: 1.5

vendor:dlinkmodel:dap-2020scope:lteversion:1.01

Trust: 1.0

vendor:d linkmodel:dap-2020scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dap-2020scope:eqversion:dap-2020 firmware

Trust: 0.8

vendor:d linkmodel:dap-2020scope:lteversion:<=1.01

Trust: 0.6

sources: ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // JVNDB: JVNDB-2021-014129 // NVD: CVE-2021-34860

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-34860
value: MEDIUM

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2021-34860
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-34860
value: MEDIUM

Trust: 0.8

ZDI: CVE-2021-34860
value: MEDIUM

Trust: 0.7

CNVD: CNVD-2021-67521
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202108-1619
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2021-34860
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-67521
severity: MEDIUM
baseScore: 6.1
vectorString: AV:A/AC:L/AU:N/C:C/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2021-34860
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-34860
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

ZDI: CVE-2021-34860
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // JVNDB: JVNDB-2021-014129 // CNNVD: CNNVD-202108-1619 // NVD: CVE-2021-34860 // NVD: CVE-2021-34860

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

problemtype:Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-014129 // NVD: CVE-2021-34860

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202108-1619

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202108-1619

PATCH

title:Multiple Vulnerabilityurl:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201

Trust: 1.5

title:Patch for D-Link DAP-2020 directory traversal vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/288981

Trust: 0.6

title:D-Link DAP-2020 Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164631

Trust: 0.6

sources: ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // JVNDB: JVNDB-2021-014129 // CNNVD: CNNVD-202108-1619

EXTERNAL IDS

db:NVDid:CVE-2021-34860

Trust: 4.6

db:ZDIid:ZDI-21-976

Trust: 3.8

db:DLINKid:SAP10201

Trust: 1.6

db:JVNDBid:JVNDB-2021-014129

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-12103

Trust: 0.7

db:CNVDid:CNVD-2021-67521

Trust: 0.6

db:CS-HELPid:SB2021100105

Trust: 0.6

db:CNNVDid:CNNVD-202108-1619

Trust: 0.6

db:VULMONid:CVE-2021-34860

Trust: 0.1

sources: ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // VULMON: CVE-2021-34860 // JVNDB: JVNDB-2021-014129 // CNNVD: CNNVD-202108-1619 // NVD: CVE-2021-34860

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-976/

Trust: 3.7

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10201

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-34860

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021100105

Trust: 0.6

sources: ZDI: ZDI-21-976 // CNVD: CNVD-2021-67521 // VULMON: CVE-2021-34860 // JVNDB: JVNDB-2021-014129 // CNNVD: CNNVD-202108-1619 // NVD: CVE-2021-34860

CREDITS

chung96vn of Vietnam National Cyber Security Center

Trust: 1.3

sources: ZDI: ZDI-21-976 // CNNVD: CNNVD-202108-1619

SOURCES

db:ZDIid:ZDI-21-976
db:CNVDid:CNVD-2021-67521
db:VULMONid:CVE-2021-34860
db:JVNDBid:JVNDB-2021-014129
db:CNNVDid:CNNVD-202108-1619
db:NVDid:CVE-2021-34860

LAST UPDATE DATE

2024-08-14T14:18:20.048000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-976date:2021-08-18T00:00:00
db:CNVDid:CNVD-2021-67521date:2021-09-02T00:00:00
db:JVNDBid:JVNDB-2021-014129date:2022-10-05T06:08:00
db:CNNVDid:CNNVD-202108-1619date:2021-10-28T00:00:00
db:NVDid:CVE-2021-34860date:2023-04-26T19:27:52.350

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-976date:2021-08-18T00:00:00
db:CNVDid:CNVD-2021-67521date:2021-09-02T00:00:00
db:JVNDBid:JVNDB-2021-014129date:2022-10-05T00:00:00
db:CNNVDid:CNNVD-202108-1619date:2021-08-18T00:00:00
db:NVDid:CVE-2021-34860date:2021-10-25T17:15:08.417