Login Sign Up

CVE-2021-44127

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability allows authenticated attackers to execute arbitrary system commands on D-Link DAP-1360 wireless access points by exploiting a command injection flaw in the webupg binary. Attackers can achieve remote code execution with administrative privileges, affecting all users of vulnerable firmware versions.

💻 Affected Systems

Products:
  • D-Link DAP-1360 Wireless Access Point
Versions: Firmware version <= v6.10
Operating Systems: Embedded Linux-based firmware
Default Config Vulnerable: ⚠️ Yes
Notes: Requires attacker to be authenticated to the web interface, but default credentials are often unchanged.

📦 What is this software?

Dap 1360f1 Firmware by Dlink

View all CVEs affecting Dap 1360f1 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.

🟠

Likely Case

Attacker gains full administrative control of the access point, enabling network monitoring, credential theft, and lateral movement within the network.

🟢

If Mitigated

Limited impact if device is isolated in a segmented network with strict firewall rules and monitored for suspicious activity.

🌐 Internet-Facing: HIGH - Access points are often exposed to the internet for remote management, making them prime targets for exploitation.
🏢 Internal Only: MEDIUM - Internal attackers or malware could exploit this to gain foothold in network infrastructure.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploit requires authentication but uses simple command injection via the 'file' parameter when 'name=deleteFile'.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware version > v6.10

Vendor Advisory: https://www.dlink.com/en/security-bulletin/

Restart Required: Yes

Instructions:

1. Download latest firmware from D-Link support site. 2. Log into web interface. 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for reboot (do not interrupt power).

🔧 Temporary Workarounds

Disable remote management

all

Prevent external access to web interface by disabling WAN-side management

Change default credentials

all

Use strong, unique passwords for administrative access

🧯 If You Can't Patch

  • Isolate device in separate VLAN with strict firewall rules
  • Implement network monitoring for suspicious traffic to/from the device

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web interface under Status > Device Info. If version <= 6.10, device is vulnerable.

Check Version:

No CLI command available. Use web interface at Status > Device Info.

Verify Fix Applied:

After firmware update, verify version shows > 6.10 in Status > Device Info.

📡 Detection & Monitoring

Log Indicators:

  • Unusual file deletion requests in web logs
  • Multiple failed login attempts followed by successful login

Network Indicators:

  • Unexpected outbound connections from access point
  • Traffic patterns suggesting command execution

SIEM Query:

source="dap-1360-logs" AND (uri="*deleteFile*" OR method="POST" AND uri="*webupg*")

📊 Metadata

CVE ID: CVE-2021-44127
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: March 27, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON