Overview

Beginning on August 21, 2020, a 3rd party security research team, Trend Micro's Zero Day Initiative (ZDI, submitted a series of three (3) reports accusing the (non-US) DAP-2020 Hardware Revision A with firmware v1.01 of several security vulnerabilities. These vulnerabilities were confirmed, and patches began to be developed under our 90-day response for active products.

On October 2, 2020, through October 28, 2020, a 3rd party security researcher, Sven Krewitt of Risk-Based Security submit seven (7) reports accusing the (non-US) DAP-2020 Hardware Revision A with firmware v1.01 of several security vulnerabilities. These vulnerabilities were confirmed, and a patch for all vulnerabilities has been released. Please see below for the new hot-fix firmware.

3rd Party Report information (Ordered by Date of Submission)

          - Reports provided:  - chung96vn ft phieulang & Chi Tran  and SUID working with Trend Micro's Zero Day Initiative (ZDI) :: zdi-disclosures _at_ trendmicro _dot_ com

                   - Vulnerability A : 08/21/2020 : CVE-2021-27248 :: Webproc getpage Stack-based Buffer Overflow RCE Vulnerability
                   - Vulnerability B : 09/08/2020 : CVE-2021-27249 :: WEB_CmdFileList Command Injection Remote Code Execution Vulnerability
                   - Vulnerability C : 09/08/2020 : CVE-2021-27250 :: Errorpage External Control of File Name Information Disclosure Vulnerability
                   - Vulnerability D : 03/12/2020 : : CVE-2021-34860: D-Link DAP-2020 webproc getpage Directory Traversal Information Disclosure Vulnerability
                   - Vulnerability E :: 03/12/2020 : CVE-2021-34861: D-Link DAP-2020 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability
                   - Vulnerability F : 03/12/2020 : CVE-2021-34862 D-Link DAP-2020 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability
                   - Vulnerability G :: 03/12/2020 : CVE-2021-34863: D-Link DAP-2020 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability

          - Reports provided: Sven Krewitt : Risk Based Security : sven _at_ riskbasedsecurity _dot_ com

                   - Vulnerability H : 10/02/2020 : Webupg sessionid Handling Remote Heap-based Buffer Overflow
                   - Vulnerability I : 10/05/2020 : Insecure sessionid Generation Remote Session Hijacking Weakness
                   - Vulnerability J : 10/06/2020 : Webproc WEB_GetCgiVars() Function Multiple Parameters Remote Stack Buffer Overflows
                   - Vulnerability K : 10/13/2020 : Webproc WEB_DisplayPage() Function Multiple Parameter Remote Stack Buffer Overflow
                   - Vulnerability L : 10/28/2020 : Webproc main() Function HTTP POST Parameter Handling Remote Stack Buffer Overflow
                   - Vulnerability M : 10/28/2020 : WEB_PostObjAuth() Function HTTP POST Parameter Handling Remote Heap Buffer Overflow
                   - Vulnerability N : 10/28/2020 : libssap.so COMM_MakeCustomMsg() Function Stack Buffer Overflow

 Affected Models

Regarding the Security patch for your D-Link Devices

Firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually, and we strongly recommend all users to install the relevant updates.

Please note that this is a device beta software, beta firmware, or hot-fix release which is still undergoing final testing before its official release. The beta software, beta firmware, or hot-fix is provided on an "as is" and "as available" basis, and the user assumes all risk and liability for use thereof. D-Link does not offer any warranties, whether express or implied, as to the beta firmware's suitability or usability. D-Link will not be liable for any loss, whether such loss is direct, indirect, special, or consequential, suffered by any party due to their use of the beta firmware.

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the product's underside next to the serial number. Alternatively, they can also be found on the device web configuration.