CVE-2021-28839: Null Pointer Dereference
First published: Tue Aug 10 2021(Updated: )
Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dlink Dap-2310 Firmware | =2.0.7.rc031 | |
| Dlink Dap-2310 | ||
| Dlink Dap-2330 Firmware | =1.07.rc028 | |
| Dlink Dap-2330 | ||
| Dlink Dap-2360 Firmware | =2.07.rc043 | |
| Dlink Dap-2360 | ||
| Dlink Dap-2553 Firmware | =3.06.rc027 | |
| Dlink Dap-2553 | ||
| Dlink Dap-2660 Firmware | =1.13.rc074 | |
| Dlink Dap-2660 | ||
| Dlink Dap-2690 Firmware | =3.16.rc100 | |
| Dlink Dap-2690 | ||
| Dlink Dap-2695 Firmware | =1.17.rc063 | |
| Dlink Dap-2695 | ||
| Dlink Dap-3320 Firmware | =1.01.rc014 | |
| Dlink Dap-3320 | ||
| Dlink Dap-3662 Firmware | =1.01.rc022 | |
| Dlink Dap-3662 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-28839?
CVE-2021-28839 is a Null Pointer Dereference vulnerability in certain D-Link devices.
Which D-Link devices are affected by CVE-2021-28839?
D-Link DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2660, DAP-2690, DAP-2695, DAP-3320, and DAP-3662 are affected by CVE-2021-28839.
What is the severity of CVE-2021-28839?
CVE-2021-28839 has a severity rating of 7.5 (High).
How does CVE-2021-28839 occur?
CVE-2021-28839 occurs when there is a null pointer dereference in the upload_certificate function of the affected devices.
Where can I find more information about CVE-2021-28839?
You can find more information about CVE-2021-28839 in the following references: [Link 1](https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve.pdf), [Link 2](https://github.com/zyw-200/EQUAFL/blob/main/dlink-email-cve2.pdf), [Link 3](https://www.dlink.com/en/security-bulletin/).
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/dlink
- canonical/dlink dap-2310 firmware
- version/dlink dap-2310 firmware/2.0.7.rc031
- canonical/dlink dap-2310
- canonical/dlink dap-2330 firmware
- version/dlink dap-2330 firmware/1.07.rc028
- canonical/dlink dap-2330
- canonical/dlink dap-2360 firmware
- version/dlink dap-2360 firmware/2.07.rc043
- canonical/dlink dap-2360
- canonical/dlink dap-2553 firmware
- version/dlink dap-2553 firmware/3.06.rc027
- canonical/dlink dap-2553
- canonical/dlink dap-2660 firmware
- version/dlink dap-2660 firmware/1.13.rc074
- canonical/dlink dap-2660
- canonical/dlink dap-2690 firmware
- version/dlink dap-2690 firmware/3.16.rc100
- canonical/dlink dap-2690
- canonical/dlink dap-2695 firmware
- version/dlink dap-2695 firmware/1.17.rc063
- canonical/dlink dap-2695
- canonical/dlink dap-3320 firmware
- version/dlink dap-3320 firmware/1.01.rc014
- canonical/dlink dap-3320
- canonical/dlink dap-3662 firmware
- version/dlink dap-3662 firmware/1.01.rc022
- canonical/dlink dap-3662