CVE-2021-27250

CWE-734 documents4 sources

Severity

6.5MEDIUM

EPSS

70.6%

top 1.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

D-link Dap-2020 Dlink Dap-2020 Firmware

Timeline

PublishedApr 14

Latest updateJul 2

Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored cred…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5d-link/dap-2020v1.01rc001

▶NVDdlink/dap-2020_firmware1.01

Patches

Patch: supportannouncement.us.dlink.com ↗Patch: supportannouncement.us.dlink.com ↗

🔴Vulnerability Details

GHSA

GHSA-wr5r-74rp-qh45: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1↗2022-05-24

▶

CVEList

CVE-2021-27250: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1↗2021-04-14

▶

🔍Detection Rules

Suricata

ET WEB_SPECIFIC_APPS D-Link Arbitrary File Read Via webproc errorpage Parameter (CVE-2021-27250)↗2025-07-02

▶