t0ptop/DAP-1360

t0ptop/DAP-1360

GitHubGitHub
GitHubgithub.com
Releases0
Stars2
An authorization command injection vulnerability about DAP-1360
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2021-44127↗
9.8 CRITICAL10 HIGH

In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized.