ZeroDay Findings
Sign inSign up

Findings

CVE-2021-45382

D-Link Multiple Routers Remote Code Execution Vulnerability

Published Feb 17, 2022 · updated Jun 16, 2026 · dlink dir-820l firmware

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 17, 2022 · Catalog

    Detected

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

  2. Apr 4, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. Apr 25, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date Apr 25, 2022

Affected

  • cpe dlink/dir-810l firmwareversion unspecified
  • cpe dlink/dir-820l firmwareversion unspecified
  • cpe dlink/dir-820lw firmwareversion unspecified
  • cpe dlink/dir-826l firmwareversion unspecified
  • cpe dlink/dir-830l firmwareversion unspecified
  • cpe dlink/dir-836l firmwareversion unspecified
  • vendor D-Link Multiple Routersversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-45382

    A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-45382

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-45382

    30-day exploitation probability 97.8%

    first.org
  • NIST NVDVulnerability recordCVE-2021-45382

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have

    nvd.nist.gov

References