github.com
https://github.com/doudoudedi/main-DIR-816_A2_Command-injection CVE-2021-39509
CRITICAL
D-Link dir-816_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')
Record summary
CVE-2021-39509 has a selected CVSS score of 9.8 (critical).
Description
An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Oct 9, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
dir-816_firmwareBrowse D-Link / dir-816_firmware | VulnCheck | Version data not supplied | |
References
4github.com
https://github.com/doudoudedi/main-DIR-816_A2_Command-injection/blob/main/injection.md nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-39509 dlink.com
https://www.dlink.com/en/security-bulletin