CVE-2021-28838
📋 TL;DR
A null pointer dereference vulnerability in D-Link DAP series access points allows remote attackers to crash the httpd service by sending specially crafted network packets. This affects multiple DAP models running specific vulnerable firmware versions. The crash results in denial of service, potentially disrupting network connectivity.
💻 Affected Systems
- D-Link DAP-2310
- D-Link DAP-2330
- D-Link DAP-2360
- D-Link DAP-2553
- D-Link DAP-2660
- D-Link DAP-2690
- D-Link DAP-2695
- D-Link DAP-3320
- D-Link DAP-3662
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the affected access point, requiring physical reboot to restore functionality. Potential for service disruption across connected networks.
Likely Case
HTTP service crash causing temporary network interruption until automatic or manual service restart occurs.
If Mitigated
Minimal impact if devices are behind firewalls with restricted access to management interfaces.
🎯 Exploit Status
Exploitation requires sending specific network packets to trigger the atoi null pointer dereference. Public research documents demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check D-Link security bulletin for updated firmware versions
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: Yes
Instructions:
1. Visit D-Link security bulletin for affected models. 2. Download latest firmware for your specific model. 3. Log into device web interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot device after update completes.
🔧 Temporary Workarounds
Restrict HTTP Management Access
allLimit access to the device's HTTP management interface to trusted networks only
Configure firewall rules to block external access to port 80/tcp and 443/tcp on affected devices
Disable HTTP Management
allUse alternative management methods if available
Disable HTTP management interface in device configuration if SSH or console access is sufficient
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict access controls
- Implement network monitoring for abnormal HTTP traffic patterns to the management interfaces
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI against the vulnerable versions listed in affected_systems.versionsCheck Version:
Check via web interface at System Status or via CLI with appropriate model-specific commandsVerify Fix Applied:
Verify firmware version has been updated to a version not listed in the vulnerable versions. Test HTTP service stability with normal operations.📡 Detection & Monitoring
Log Indicators:
- HTTP service crash logs
- Repeated httpd process restarts
- Abnormal termination messages in system logs
Network Indicators:
- Unusual HTTP requests to device management interfaces
- Sudden loss of HTTP service on standard ports
SIEM Query:
source="dlink_access_point" AND (event="httpd_crash" OR event="service_restart" OR message="*null pointer*" OR message="*segmentation fault*")🔗 References
- https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf
- https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf
- https://www.dlink.com/en/security-bulletin/
- https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf
- https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf
- https://www.dlink.com/en/security-bulletin/
