Lucene search

MitreCVE-2021-28840

HistoryAug 10, 2021 - 6:15 p.m.

CVE-2021-28840

2021-08-1018:15:07

CWE-476

mitre

web.nvd.nist.gov

cve

2021

28840

null pointer dereference

d-link

dap-2310

dap-2330

dap-2360

dap-2553

dap-2660

dap-2690

dap-2695

dap-3320

dap-3662

sbin/httpd binary

vulnerability

nvd.

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

54.8%

JSON

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_config function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the content in upload_file variable is NULL in the upload_config function then the strncasecmp would take NULL as first argument, and incur the NULL pointer dereference vulnerability.

Affected configurations

Nvd

Node

dlinkdap-2310_firmwareMatch2.0.7.rc031

AND

dlinkdap-2310Match-

Node

dlinkdap-2330_firmwareMatch1.07.rc028

AND

dlinkdap-2330Match-

Node

dlinkdap-2360_firmwareMatch2.07.rc043

AND

dlinkdap-2360Match-

Node

dlinkdap-2553_firmwareMatch3.06.rc027

AND

dlinkdap-2553Match-

Node

dlinkdap-2660_firmwareMatch1.13.rc074

AND

dlinkdap-2660Match-

Node

dlinkdap-2690_firmwareMatch3.16.rc100

AND

dlinkdap-2690Match-

Node

dlinkdap-2695_firmwareMatch1.17.rc063

AND

dlinkdap-2695Match-

Node

dlinkdap-3320_firmwareMatch1.01.rc014

AND

dlinkdap-3320Match-

Node

dlinkdap-3662_firmwareMatch1.01.rc022

AND

dlinkdap-3662Match-

VendorProductVersionCPE
dlinkdap-2310_firmware2.0.7.rc031cpe:2.3:o:dlink:dap-2310_firmware:2.0.7.rc031:*:*:*:*:*:*:*
dlinkdap-2310-cpe:2.3:h:dlink:dap-2310:-:*:*:*:*:*:*:*
dlinkdap-2330_firmware1.07.rc028cpe:2.3:o:dlink:dap-2330_firmware:1.07.rc028:*:*:*:*:*:*:*
dlinkdap-2330-cpe:2.3:h:dlink:dap-2330:-:*:*:*:*:*:*:*
dlinkdap-2360_firmware2.07.rc043cpe:2.3:o:dlink:dap-2360_firmware:2.07.rc043:*:*:*:*:*:*:*
dlinkdap-2360-cpe:2.3:h:dlink:dap-2360:-:*:*:*:*:*:*:*
dlinkdap-2553_firmware3.06.rc027cpe:2.3:o:dlink:dap-2553_firmware:3.06.rc027:*:*:*:*:*:*:*
dlinkdap-2553-cpe:2.3:h:dlink:dap-2553:-:*:*:*:*:*:*:*
dlinkdap-2660_firmware1.13.rc074cpe:2.3:o:dlink:dap-2660_firmware:1.13.rc074:*:*:*:*:*:*:*
dlinkdap-2660-cpe:2.3:h:dlink:dap-2660:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dap-2310_firmware	2.0.7.rc031	cpe:2.3:o:dlink:dap-2310_firmware:2.0.7.rc031:::::::*
dlink	dap-2310	-	cpe:2.3:h:dlink:dap-2310:-:::::::*
dlink	dap-2330_firmware	1.07.rc028	cpe:2.3:o:dlink:dap-2330_firmware:1.07.rc028:::::::*
dlink	dap-2330	-	cpe:2.3:h:dlink:dap-2330:-:::::::*
dlink	dap-2360_firmware	2.07.rc043	cpe:2.3:o:dlink:dap-2360_firmware:2.07.rc043:::::::*
dlink	dap-2360	-	cpe:2.3:h:dlink:dap-2360:-:::::::*
dlink	dap-2553_firmware	3.06.rc027	cpe:2.3:o:dlink:dap-2553_firmware:3.06.rc027:::::::*
dlink	dap-2553	-	cpe:2.3:h:dlink:dap-2553:-:::::::*
dlink	dap-2660_firmware	1.13.rc074	cpe:2.3:o:dlink:dap-2660_firmware:1.13.rc074:::::::*
dlink	dap-2660	-	cpe:2.3:h:dlink:dap-2660:-:::::::*

Rows per page:

1-10 of 181

References

github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf

github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf

www.dlink.com/en/security-bulletin/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

54.8%

JSON

Related for CVE-2021-28840