CVE-2021-34860 — Path Traversal in Dlink Dap-2020 Firmware

CWE-22 — Path Traversal3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
13.2%
top 5.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dlink Dap-2020 FirmwareD-link Dap-2020
Timeline
PublishedOct 25
Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to the webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information …

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5d-link/dap-20201.01rc001

Patches

Patch: supportannouncement.us.dlink.com ↗Patch: supportannouncement.us.dlink.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2w9j-55xj-gcp3: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1↗2022-05-24
▶
CVEList
CVE-2021-34860: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1↗2021-10-25
▶
CVE-2021-34860 — Path Traversal in Dlink | cvebase