CVE-2021-39509: Command Injection
An issue was discovered in D-Link DIR-816 DIR-816A2FWv1.10CNB05R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route, which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
D-Link DIR-816 DIR-816A2to a version that resolves this vulnerability.Fixed in DIR-816A2_FWv1.10CNB05_R1B011D88210Patch DIR-816A2_FWv1.10CNB05_R1B011D88210
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39509?
The severity of CVE-2021-39509 is critical with a score of 9.8.
How does CVE-2021-39509 affect D-Link DIR-816 Firmware?
CVE-2021-39509 affects D-Link DIR-816 Firmware version 1.10cnb05_r1b011d88210.
What is the impact of CVE-2021-39509?
CVE-2021-39509 allows for command injection through shell metacharacters, which can lead to unauthorized execution of commands.
Are there any known fixes or patches for CVE-2021-39509?
At the moment, there are no known fixes or patches available for CVE-2021-39509. It is recommended to follow the vendor's security bulletin for updates.
Where can I find more information about CVE-2021-39509?
You can find more information about CVE-2021-39509 at the following sources: [GitHub - doudoudedi/main-DIR-816_A2_Command-injection](https://github.com/doudoudedi/main-DIR-816_A2_Command-injection), [GitHub - doudoudedi/main-DIR-816_A2_Command-injection/blob/main/injection.md](https://github.com/doudoudedi/main-DIR-816_A2_Command-injection/blob/main/injection.md), [D-Link Security Bulletin](https://www.dlink.com/en/security-bulletin/).