CVE-2021-27250
Using DAP-2020 by D-Link?
Get instant alerts when new vulnerabilities affect DAP-2020 - before attackers find them.
Description
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-11856.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (2)
CVSS
- Attack Vector
- ADJACENT_NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.