peter bassill · operator
$ cve CVE-2021-45382 JSON

CVE-2021-45382 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 97.8% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-25.

Description

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS97.84% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2022-04-25
Public exploitnone known
Published2022-02-17
Last modified2026-06-17

CISA KEV

NameD-Link Multiple Routers Remote Code Execution Vulnerability
Added2022-04-04
Due2022-04-25
Vendor / productD-Link / Multiple Routers
Ransomware usenone reported

Affected (12)

VendorProduct
dlinkdir-810l
dlinkdir-810l firmware
dlinkdir-820l
dlinkdir-820l firmware
dlinkdir-820lw
dlinkdir-820lw firmware
dlinkdir-826l
dlinkdir-826l firmware
dlinkdir-830l
dlinkdir-830l firmware
dlinkdir-836l
dlinkdir-836l firmware

References

→ the Explorer  ·  watch your stack  ·  NVD