CVE-2021-27249: d-link dap-2020 OS Command Injection

Vulnerability summary

CVE-2021-27249 is a high (CVSS 8.8) OS Command Injection vulnerability in d-link dap-2020. EPSS estimates a 5.09% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.

Timeline

1. 14-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11369.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.