ZDI-21-204: D-Link DAP-2020 WEB_CmdFileList Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-21-204?
ZDI-21-204 has been assigned a high severity rating due to its potential to allow arbitrary code execution.
How can I mitigate the risk associated with ZDI-21-204?
To mitigate ZDI-21-204, update the D-Link DAP-2020 firmware to the latest version provided by the vendor.
Who is affected by the ZDI-21-204 vulnerability?
The vulnerability ZDI-21-204 affects users of D-Link DAP-2020 Wi-Fi access points.
What type of access is required to exploit ZDI-21-204?
No authentication is required to exploit the ZDI-21-204 vulnerability, making it easier for attackers.
What is the impact of ZDI-21-204?
The impact of ZDI-21-204 allows network-adjacent attackers to execute arbitrary code on affected devices.