CVE-2021-46455 – This vulnerability allows attackers to execute ... (How to Fix)

Q: What is the severity of CVE-2021-46455?

CVE-2021-46455 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to execute arbitrary commands on D-Link DIR-823-Pro routers via the station_access_enable parameter in the SetStationSettings function. Attackers can gain full control of affected devices, potentially compromising network security. Only D-Link DIR-823-Pro v1.0.2 devices are affected.

📋 TL;DR

This vulnerability allows attackers to execute arbitrary commands on D-Link DIR-823-Pro routers via the station_access_enable parameter in the SetStationSettings function. Attackers can gain full control of affected devices, potentially compromising network security. Only D-Link DIR-823-Pro v1.0.2 devices are affected.

💻 Affected Systems

Products:

D-Link DIR-823-Pro

Versions: v1.0.2

Operating Systems: Embedded Linux firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Only this specific model and version are affected. Other D-Link devices or different firmware versions are not vulnerable.

📦 What is this software?

Dir 823 Pro Firmware by Dlink

View all CVEs affecting Dir 823 Pro Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device takeover leading to network compromise, data exfiltration, lateral movement to other devices, and persistent backdoor installation.

🟠

Likely Case

Router compromise allowing traffic interception, DNS hijacking, credential theft, and use as attack platform against internal network.

🟢

If Mitigated

Limited impact if device is isolated, properly segmented, and monitored with network intrusion detection.

🌐 Internet-Facing: HIGH - Routers are typically internet-facing, making them prime targets for remote exploitation.

🏢 Internal Only: MEDIUM - If not internet-facing, risk reduces but still vulnerable to internal attackers or compromised devices.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires authentication but is trivial to execute once authenticated. Public proof-of-concept code exists in GitHub repositories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: v1.0.2B05 or later

Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10285

Restart Required: Yes

Instructions:

1. Download latest firmware from D-Link support site. 2. Log into router admin interface. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload firmware file. 5. Wait for automatic reboot.

🔧 Temporary Workarounds

Disable remote management

all

Prevent external access to admin interface

Network segmentation

all

Isolate router management interface from general network

🧯 If You Can't Patch

Replace affected device with patched model or different vendor
Implement strict network access controls and monitor for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check firmware version in router admin interface under System Tools > Firmware

Check Version:

No CLI command - check via web interface at http://router_ip

Verify Fix Applied:

Verify firmware version shows v1.0.2B05 or later

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to SetStationSettings
Multiple failed login attempts followed by successful login

Network Indicators:

Unexpected outbound connections from router
DNS queries to suspicious domains

SIEM Query:

source="router_logs" AND (uri="/SetStationSettings" OR message="station_access_enable")

📊 Metadata

CVE ID: CVE-2021-46455

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-77

Published: February 4, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/pjqwudi/my_vuln/blob/main/D-link/vuln_22/22.md Broken Link
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10285 Vendor Advisory
https://www.dlink.com/en/security-bulletin/ Vendor Advisory
https://github.com/pjqwudi/my_vuln/blob/main/D-link/vuln_22/22.md Broken Link
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10285 Vendor Advisory
https://www.dlink.com/en/security-bulletin/ Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-46455, you might also want to check these: