CVE-2021-46319

CWE-78 — OS Command Injection3 documents3 sources

Severity

9.8CRITICAL

EPSS

21.0%

top 4.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-846 Firmware

Timeline

PublishedFeb 17

Latest updateFeb 18

Description

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDdlink/dir-846_firmware100a43, 100a53dla+1

🔴Vulnerability Details

GHSA

GHSA-mq76-pcfx-jm9r: Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43↗2022-02-18

▶

CVEList

CVE-2021-46319: Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43↗2022-02-17

▶