CVE-2021-28838
High
Description
Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b, DAP-2690 3.20RC115 BETA, DAP-2695 1.20RC093, DAP-3320 1.05RC027 BETA and DAP-3662 1.05rc069 in the sbin/httpd binary. The crash happens at the `atoi' operation when a specific network package are sent to the httpd binary.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDlink Dap-2310 Firmware
PublishedAug 10, 2021
First seenAug 10, 2021
How to fix
Update
- dlink dap-2330_firmware1.10rc036 or later
- dlink dap-2553_firmware3.10rc039 or later
- dlink dap-2690_firmware3.20rc115 or later
- dlink dap-3320_firmware1.05rc027 or later
- dlink dap-3662_firmware1.05rc069 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dlink dap-2310_firmware | v ≤ 2.10rc039 | — |
| dlink dap-2330_firmware | v < 1.10rc036, 1.10rc036 | 1.10rc036 |
| dlink dap-2360_firmware | v ≤ 2.10rc055 | — |
| dlink dap-2553_firmware | v < 3.10rc039, 3.10rc039 | 3.10rc039 |
| dlink dap-2660_firmware | v ≤ 1.15rc131b | — |
| dlink dap-2690_firmware | v < 3.20rc115, 3.20rc115 | 3.20rc115 |
| dlink dap-2695_firmware | v ≤ 1.20rc093 | — |
| dlink dap-3320_firmware | v < 1.05rc027, 1.05rc027 | 1.05rc027 |
| dlink dap-3662_firmware | v < 1.05rc069, 1.05rc069 | 1.05rc069 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.