CVE-2021-28144

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Mar/23Mailing List, Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208Patch, Vendor Advisory
https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/161757/D-Link-DIR-3060-1.11b04-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Mar/23Mailing List, Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10208Patch, Vendor Advisory
https://www.iot-inspector.com/blog/advisory-d-link-dir-3060/Exploit, Third Party Advisory

Timeline

Published: Mar 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281455.4Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This req CVE-2021-281466.5The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an externa CVE-2021-281476.5The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control iss CVE-2021-281487.5One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible CVE-2021-281496.5Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a r CVE-2021-281505.5Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) v CVE-2021-281518.8Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg CVE-2021-281529.8Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is us CVE-2021-281535.3An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path CVE-2021-281549.1Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the ex CVE-2021-281556.5The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses CVE-2021-281567.5HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8