CVE-2021-27250

published 2021-04-14

CVE-2021-27250: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access…

Priority P3 54 medium 6.5 CVSS 3.1

AV A AC L PR N UI N S U C H I N A N

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-11856.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	dap-2020	—	—
dlink	dap-2020_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /cgi-bin/webproc

cookie sys_UserName=admin

command errorpage=

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link Arbitrary File Read Via webproc errorpage Parameter (CVE-2021-27250)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/cgi-bin/webproc"; fast_pattern; http.cookie; content:"sys_UserName|3d|admin"; http.request_body; content:"errorpage|3d|"; pcre:"/^(?:\x2f|[^\x26]*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){2,})/R"; reference:cve,2021-27250; reference:url,github.com/PeiQi0/PeiQi-WIKI-Book/tree/main/docs/wiki/iot; classtype:attempted-admin; sid:2063272; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_02, cve CVE_2021_27250, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Look for HTTP POST requests to /cgi-bin/webproc (exactly 16 bytes URI) with a request body containing the 'errorpage=' parameter set to a path traversal sequence (e.g., ../../) or an absolute path starting with '/'.
• → The attack does not require authentication; however, the Snort rule specifically matches the cookie value 'sys_UserName=admin', indicating exploitation attempts may spoof or supply this cookie value to trigger the vulnerable code path.
• → Path traversal sequences in the errorpage parameter may be URL-encoded; detect both literal dot-slash (../) and encoded variants (%2e, %2f, %5c) in the POST body.
• → The goal of exploitation is credential disclosure; monitor for file read responses containing credential material (e.g., /etc/passwd or device config files) following POST requests to /cgi-bin/webproc.

• · The Snort rule enforces an exact URI byte size of 16 (bsize:16) for /cgi-bin/webproc. Any variant with query strings or additional path components appended to the URI would bypass this match; tune accordingly for your environment.
• · The rule is scoped to plaintext HTTP traffic only (tls_state plaintext); if the device is accessed over HTTPS or a non-standard port, the rule will not fire.
• · The rule targets traffic flowing TO $HOME_NET (inbound to the network). If D-Link DAP-2020 devices are deployed in a DMZ or on a separate segment not covered by $HOME_NET, the rule must be adjusted.

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 3.3 LOW AV:A/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-73