CVE-2021-28838 is a null pointer dereference vulnerability affecting various D-Link DAP series access points, including models like the DAP-2310, DAP-2330, and DAP-2695. This flaw, residing in the sbin/httpd binary, can be triggered by sending a specially crafted network package that causes a crash during an 'atoi' operation. With a CVSS v3.1 score of 7.5 (HIGH), it presents a network-based attack vector with low complexity, requiring no privileges or user interaction, and leading to high availability impact (denial of service). Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.10rc039CPE matchmatch criteria | cpe:2.3:o:dlink:dap-2310_firmware:*:*:*:*:*:*:*:* | ||
< 1.10rc036CPE matchmatch criteria | cpe:2.3:o:dlink:dap-2330_firmware:*:*:*:*:*:*:*:* | ||
1.10rc036CPE matchmatch criteria | cpe:2.3:o:dlink:dap-2330_firmware:1.10rc036:beta:*:*:*:*:*:* | ||
<= 2.10rc055CPE matchmatch criteria | cpe:2.3:o:dlink:dap-2360_firmware:*:*:*:*:*:*:*:* | ||
< 3.10rc039CPE matchmatch criteria | cpe:2.3:o:dlink:dap-2553_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.