Lucene search

[email protected]CVE-2021-28838

HistoryAug 10, 2021 - 6:15 p.m.

CVE-2021-28838

2021-08-1018:15:00

CWE-476

[email protected]

web.nvd.nist.gov

cve-2021-28838

d-link

dap

null pointer dereference

vulnerability

httpd

sbin

network package

atoi operation

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

54.6%

JSON

Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b, DAP-2690 3.20RC115 BETA, DAP-2695 1.20RC093, DAP-3320 1.05RC027 BETA and DAP-3662 1.05rc069 in the sbin/httpd binary. The crash happens at the `atoi’ operation when a specific network package are sent to the httpd binary.

CPENameOperatorVersion
dlink:dap-2310_firmwaredlink dap-2310 firmwarele2.10rc039
dlink:dap-2330_firmwaredlink dap-2330 firmwarelt1.10rc036
dlink:dap-2360_firmwaredlink dap-2360 firmwarele2.10rc055
dlink:dap-2553_firmwaredlink dap-2553 firmwarelt3.10rc039
dlink:dap-2660_firmwaredlink dap-2660 firmwarele1.15rc131b
dlink:dap-2690_firmwaredlink dap-2690 firmwarelt3.20rc115
dlink:dap-2695_firmwaredlink dap-2695 firmwarele1.20rc093
dlink:dap-3320_firmwaredlink dap-3320 firmwarelt1.05rc027
dlink:dap-3662_firmwaredlink dap-3662 firmwarelt1.05rc069

CPE	Name	Operator	Version
dlink:dap-2310_firmware	dlink dap-2310 firmware	le	2.10rc039
dlink:dap-2330_firmware	dlink dap-2330 firmware	lt	1.10rc036
dlink:dap-2360_firmware	dlink dap-2360 firmware	le	2.10rc055
dlink:dap-2553_firmware	dlink dap-2553 firmware	lt	3.10rc039
dlink:dap-2660_firmware	dlink dap-2660 firmware	le	1.15rc131b
dlink:dap-2690_firmware	dlink dap-2690 firmware	lt	3.20rc115
dlink:dap-2695_firmware	dlink dap-2695 firmware	le	1.20rc093
dlink:dap-3320_firmware	dlink dap-3320 firmware	lt	1.05rc027
dlink:dap-3662_firmware	dlink dap-3662 firmware	lt	1.05rc069

References

github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf

github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf

www.dlink.com/en/security-bulletin/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

54.6%

JSON

Related for CVE-2021-28838

prion1 cvelist1 cnvd1