CVE-2021-29296
📋 TL;DR
A null pointer dereference vulnerability in D-Link DIR-825 routers allows remote attackers to cause denial of service by sending a specially crafted HTTP request to the /vct_wan endpoint. This affects all hardware revisions of the DIR-825 router running firmware version 2.10b02. The device is end-of-life and will not receive patches.
💻 Affected Systems
- D-Link DIR-825
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, disrupting all network services for connected users
Likely Case
Temporary denial of service until device automatically restarts or is manually rebooted
If Mitigated
No impact if device is not internet-facing or properly firewalled
🎯 Exploit Status
Simple HTTP request to trigger vulnerability, no authentication required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10212
Restart Required: No
Instructions:
No official patch available. Device is End of Life. Replace with supported hardware.
🔧 Temporary Workarounds
Block HTTP access to /vct_wan endpoint
linuxConfigure firewall rules to block HTTP requests to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/vct_wan" --algo bm -j DROP
Disable web administration interface
allTurn off HTTP administration if not needed
Check router admin interface for web admin toggle
🧯 If You Can't Patch
- Replace DIR-825 with supported router model
- Isolate router behind firewall, disable WAN access to admin interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface or via curl -v http://router-ip/vct_wan (may crash device)Check Version:
Check router web interface or use nmap -sV router-ipVerify Fix Applied:
No fix available to verify. Replacement is required.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /vct_wan endpoint
- httpd process crashes or segmentation faults
Network Indicators:
- HTTP GET requests to /vct_wan from external IPs
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND (uri="/vct_wan" OR message="segmentation fault" OR message="httpd crashed")