CVE-2021-29379

An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

5.8 MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.50% chance of exploitation in the next 30 days, 88th percentile

Published

2021-04-12

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://cool-y.github.io/2021/03/02/DIR-802-OS-Command-Injection

Exploit collections (1)

• tzwlhack/Vulnerability/blob/main/D-LINK%20DIR-802%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%…

References

• CVE Record
• NVD entry

Related

• CVE-2021-29378
• CVE-2021-29387
• CVE-2021-29349
• CVE-2021-29388
• CVE-2021-29343
• CVE-2021-29425