CVE-2021-28144

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

6.01% chance of exploitation in the next 30 days, 93th percentile

Published

2021-03-11

Updated

2024-08-03

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html

References

• CVE Record
• NVD entry

Related

• CVE-2021-28143
• CVE-2021-28149
• CVE-2021-28142
• CVE-2021-28150
• CVE-2021-28132
• CVE-2021-28151