CVE-2021-28144

HIGH

8.8

Description

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/11/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

dlink:dir-3060dlink:dir-3060_firmware

Weaknesses (CWE)

CWE-78

References

http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html(cve@mitre.org)

http://seclists.org/fulldisclosure/2021/Mar/23(cve@mitre.org)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208(cve@mitre.org)

https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/(cve@mitre.org)

http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2021/Mar/23(af854a3a-2127-422b-91ae-364da2661108)

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208(af854a3a-2127-422b-91ae-364da2661108)

https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.