CVE-2021-28839

2021-08-1017:29:13

mitre

www.cve.org

d-link

dap-2310

dap-2330

dap-2360

dap-2553

dap-2660

dap-2690

dap-2695

dap-3320

dap-3662

upload_certificate function

http get

strrchr

null pointer

EPSS

0.002

Percentile

54.8%

JSON

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.