JVNVU#92898656
D-Link DAP-1880AC contains multiple vulnerabilities

Overview

DAP-1880AC provided by D-Link Japan K.K. contains multiple vulnerabilities.

Products Affected

• DAP-1880AC firmware version 1.21 and prior

Description

DAP-1880AC provided by D-Link Japan K.K. contains multiple vulnerabilities listed below.

• Improper access control (CWE-284) - CVE-2021-20694

  CVSS v3

  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

  Base Score: 5.0

• Improper privilege management (CWE-296) - CVE-2021-20695

  CVSS v3

  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  Base Score: 8.8

• OS command injection (CWE-78) - CVE-2021-20696

• CVSS v3

  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

  Base Score: 6.3

• Missing authentication for critical function (CWE-306) - CVE-2021-20697

  CVSS v3

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

  Base Score: 7.3

Impact

• An authenticated remote attacker can start telnet service. - CVE-2021-20694
• A low-privileged remote attacker can gain root privileges. - CVE-2021-20695
• If an authenticated remote attacker can send a specially crafted request to a specific CGI program, it may lead to an arbitrary OS command injection.  - CVE-2021-20696
• A remote attacker can login to the product as a low-privileged user without the access privilege. - CVE-2021-20697

Solution

Update firmware
Update firmware to the latest version according to the information provided by the developer.
The developer has released the fixed version 1.23.