Sign-up

ID

VAR-202110-1327


CVE

CVE-2021-34861


TITLE

D-Link DAP-2020  Stack-based buffer overflow vulnerability in routers

Trust: 0.8

sources: JVNDB: JVNDB-2021-014128

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12104. D-Link DAP-2020 A stack-based buffer overflow vulnerability exists in the router. Zero Day Initiative To this vulnerability ZDI-CAN-12104 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DAP-2020 is a wireless N access point

Trust: 2.88

sources: NVD: CVE-2021-34861 // JVNDB: JVNDB-2021-014128 // ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // VULMON: CVE-2021-34861

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-67522

AFFECTED PRODUCTS

vendor:d linkmodel:dap-2020scope: - version: -

Trust: 1.5

vendor:dlinkmodel:dap-2020scope:lteversion:1.01

Trust: 1.0

vendor:d linkmodel:dap-2020scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dap-2020scope:eqversion:dap-2020 firmware

Trust: 0.8

vendor:d linkmodel:dap-2020scope:lteversion:<=1.01

Trust: 0.6

sources: ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // JVNDB: JVNDB-2021-014128 // NVD: CVE-2021-34861

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-34861
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2021-34861
value: HIGH

Trust: 1.0

NVD: CVE-2021-34861
value: HIGH

Trust: 0.8

ZDI: CVE-2021-34861
value: HIGH

Trust: 0.7

CNVD: CNVD-2021-67522
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202108-1620
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-34861
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-67522
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2021-34861
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-34861
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2021-34861
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // JVNDB: JVNDB-2021-014128 // CNNVD: CNNVD-202108-1620 // NVD: CVE-2021-34861 // NVD: CVE-2021-34861

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:Stack-based buffer overflow (CWE-121) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-014128 // NVD: CVE-2021-34861

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202108-1620

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202108-1620

PATCH

title:Multiple Vulnerabilityurl:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201

Trust: 1.5

title:Patch for D-Link DAP-2020 stack buffer overflow vulnerability (CNVD-2021-67522)url:https://www.cnvd.org.cn/patchInfo/show/288986

Trust: 0.6

title:D-Link DAP-2020 Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164632

Trust: 0.6

sources: ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // JVNDB: JVNDB-2021-014128 // CNNVD: CNNVD-202108-1620

EXTERNAL IDS

db:NVDid:CVE-2021-34861

Trust: 4.6

db:ZDIid:ZDI-21-977

Trust: 3.8

db:DLINKid:SAP10201

Trust: 1.6

db:JVNDBid:JVNDB-2021-014128

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-12104

Trust: 0.7

db:CNVDid:CNVD-2021-67522

Trust: 0.6

db:CS-HELPid:SB2021100105

Trust: 0.6

db:CNNVDid:CNNVD-202108-1620

Trust: 0.6

db:VULMONid:CVE-2021-34861

Trust: 0.1

sources: ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // VULMON: CVE-2021-34861 // JVNDB: JVNDB-2021-014128 // CNNVD: CNNVD-202108-1620 // NVD: CVE-2021-34861

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-977/

Trust: 3.7

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10201

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-34861

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021100105

Trust: 0.6

sources: ZDI: ZDI-21-977 // CNVD: CNVD-2021-67522 // VULMON: CVE-2021-34861 // JVNDB: JVNDB-2021-014128 // CNNVD: CNNVD-202108-1620 // NVD: CVE-2021-34861

CREDITS

chung96vn ft phieulang ft ChiTran

Trust: 1.3

sources: ZDI: ZDI-21-977 // CNNVD: CNNVD-202108-1620

SOURCES

db:ZDIid:ZDI-21-977
db:CNVDid:CNVD-2021-67522
db:VULMONid:CVE-2021-34861
db:JVNDBid:JVNDB-2021-014128
db:CNNVDid:CNNVD-202108-1620
db:NVDid:CVE-2021-34861

LAST UPDATE DATE

2024-08-14T14:18:20.119000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-977date:2021-08-18T00:00:00
db:CNVDid:CNVD-2021-67522date:2021-09-02T00:00:00
db:JVNDBid:JVNDB-2021-014128date:2022-10-05T05:58:00
db:CNNVDid:CNNVD-202108-1620date:2021-10-28T00:00:00
db:NVDid:CVE-2021-34861date:2023-04-26T19:27:52.350

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-977date:2021-08-18T00:00:00
db:CNVDid:CNVD-2021-67522date:2021-09-02T00:00:00
db:JVNDBid:JVNDB-2021-014128date:2022-10-05T00:00:00
db:CNNVDid:CNNVD-202108-1620date:2021-08-18T00:00:00
db:NVDid:CVE-2021-34861date:2021-10-25T17:15:08.477