CVE-2021-28144
- State
- Published
- Severity
- Not scored
- Published
- Mar 11, 2021
- Updated
- Aug 3, 2024
- Reserved
- Mar 11, 2021
Description
prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208
- 20210311 [CVE-2021-28144] Authenticated Command Injection in D-Link DIR-3060 Web Interfacemailing-list
- http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.