CVE-2021-46315

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.mdExploit, Third Party Advisory
https://www.dlink.com/en/security-bulletin/Vendor Advisory
https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.mdExploit, Third Party Advisory
https://www.dlink.com/en/security-bulletin/Vendor Advisory

Timeline

Published: Feb 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-463199.8Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Maliciou CVE-2021-463207.5In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal p CVE-2021-463219.8Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. This vulnerabilit CVE-2021-463225.5Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stack.c.CVE-2021-463235.5Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.CVE-2021-463247.8Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.CVE-2021-463257.8Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.CVE-2021-463267.8Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __asan_memcpy.CVE-2021-463275.5Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort.CVE-2021-463287.8Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __libc_start_main.CVE-2021-463295.5Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component _fini.CVE-2021-463305.5Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat.