CVE-2021-28839

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan NULL Pointer Dereference pada dlink dap-2310 firmware, dlink dap-2330 firmware +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.

Rincian

Terbit di NVD

10 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.dlink.com/en/security-bulletin/ advisory vendor
• https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf exploit · advisory pihak ketiga
• https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf advisory pihak ketiga