CVE-2021-45998
📋 TL;DR
This CVE describes a command injection vulnerability in D-Link DIR-882 routers that allows attackers to execute arbitrary commands via crafted HNAP1 POST requests targeting the LocalIPAddress parameter. Attackers can achieve remote code execution with high privileges. Only D-Link DIR-882 routers running specific vulnerable firmware versions are affected.
💻 Affected Systems
- D-Link DIR-882
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, pivot to internal networks, intercept all network traffic, and brick the device.
Likely Case
Remote code execution leading to device takeover, credential theft, DNS hijacking, and creation of botnet nodes.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Proof-of-concept code is publicly available. Exploitation requires sending crafted HTTP POST request to HNAP1 endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check D-Link support for latest firmware
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10287
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Firmware Update section. 3. Download latest firmware from D-Link support site. 4. Upload and apply firmware update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Disable HNAP1 Protocol
allDisable the HNAP1 management protocol if not required
Check router web interface for HNAP/UPnP settings and disable
Restrict Management Access
allLimit management interface access to trusted IP addresses only
Configure firewall rules to restrict access to router management ports (typically 80, 443, 8080)
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Disable remote management and WAN access to management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or Tools > Firmware. If version is DIR_882_FW1.30B06_Hotfix_02 or earlier, device is vulnerable.Check Version:
curl -s http://router-ip/GetDeviceSettings | grep FirmwareVersionVerify Fix Applied:
Verify firmware version has been updated to latest version from D-Link support site. Test by attempting to reproduce exploit with known payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /HNAP1/ endpoints
- Commands with shell metacharacters in LocalIPAddress parameter
- Multiple failed authentication attempts followed by HNAP1 requests
Network Indicators:
- HTTP POST requests to router IP on port 80/443 with HNAP1 SOAPAction headers
- Unusual outbound connections from router to external IPs
SIEM Query:
source="router-logs" AND (url="/HNAP1/*" AND method="POST" AND (param="LocalIPAddress" AND value="*;*" OR value="*|*" OR value="*`*"))🔗 References
- https://github.com/pjqwudi/my_vuln/blob/main/D-link/vuln_4/4.md
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10287
- https://www.dlink.com/en/security-bulletin/
- https://github.com/pjqwudi/my_vuln/blob/main/D-link/vuln_4/4.md
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10287
- https://www.dlink.com/en/security-bulletin/
