CVE-2021-45382
D-Link Multiple Routers Remote Code Execution Vulnerability
Description
CVE-2021-45382 is a remote code execution vulnerability in multiple D-Link router models that allows unauthenticated attackers to execute arbitrary commands through the DDNS function in the ncc2 binary. The vulnerability can be exploited remotely over the network without authentication, giving attackers complete control of affected routers. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 97.3% (99.9th percentile), this vulnerability is extensively targeted by botnet operators and threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-820l firmware | - |
| dlink | dir-820lw firmware | - |
| dlink | dir-826l firmware | - |
| dlink | dir-830l firmware | - |
| dlink | dir-836l firmware | - |
| dlink | dir-810l firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md(Exploit, Third Party Advisory)
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45382(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when an application constructs system commands using unsanitized user input, allowing attackers to inject and execute arbitrary operating system commands. In CVE-2021-45382, the DDNS function in D-Link's ncc2 binary fails to sanitize input parameters, enabling remote command execution on the router. For more details, see CWE-78.
Impact Analysis
Exploitation of this vulnerability provides attackers with complete control over affected D-Link routers, enabling them to intercept, modify, or redirect all network traffic passing through the device. This positions the attacker for man-in-the-middle attacks, credential harvesting, DNS hijacking, and use of the router as a launching point for attacks against internal network devices. Compromised routers are frequently enrolled in botnets for DDoS attacks, spam distribution, or cryptocurrency mining. Since these routers often serve as the network perimeter for homes and small businesses, their compromise effectively eliminates the primary security boundary.
Exploit Maturity
CVE-2021-45382 was added to CISA's KEV catalog on April 4, 2022, confirming active exploitation. The EPSS score of 97.3% (99.9th percentile) indicates extremely widespread exploitation. Publicly available exploit code makes this vulnerability trivially exploitable through simple HTTP requests. The affected D-Link router models are end-of-life products that will not receive firmware updates, making this a permanent vulnerability for devices still in operation. IoT botnets including Mirai variants actively scan for and exploit this vulnerability.
Remediation
- Replace affected D-Link router models with supported devices that receive security updates, as the affected models are end-of-life and will not be patched. This is the primary remediation recommended by CISA.
- If immediate replacement is not possible, disable remote management access and restrict the DDNS functionality on affected routers.
- Place affected routers behind a separate firewall that blocks inbound access to the router's management interface.
- Monitor network traffic from affected devices for signs of compromise, including unexpected outbound connections or DNS resolution changes.
- Segment networks to minimize the impact of a compromised router on other network resources.
Technical Details
The vulnerability exists in the ncc2 binary on affected D-Link routers, specifically in the DDNS (Dynamic DNS) configuration handler. When processing DDNS-related parameters from HTTP requests, the ncc2 binary passes user-controlled input directly to system() or similar command execution functions without proper sanitization. An attacker can inject shell metacharacters and additional commands into the DDNS configuration parameters through crafted HTTP requests to the router's web interface. The injected commands execute with root privileges on the router's embedded Linux operating system. The attack does not require authentication in affected configurations, making it exploitable by any attacker with network access to the router's management interface.
Frequently Asked Questions
What is CVE-2021-45382?
CVE-2021-45382 is a remote code execution vulnerability in the DDNS function of multiple D-Link router models. It allows unauthenticated attackers to execute arbitrary commands on the router through the ncc2 binary by injecting commands via HTTP requests.
Which D-Link models are affected?
The vulnerability affects multiple D-Link router models including DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L. All affected models are end-of-life products that D-Link has discontinued and will not receive firmware updates.
Will D-Link release a patch for this vulnerability?
No. D-Link has confirmed that the affected router models are end-of-life and will not receive firmware updates. The only complete remediation is to replace the affected devices with currently supported router models.
How can I protect my network if I can't immediately replace the router?
Disable remote management access to prevent exploitation from the internet, restrict access to the router's web interface to specific trusted devices, disable the DDNS feature if not required, and plan for device replacement as soon as possible.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.