CVE-2021-41441
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
A DoS vulnerability in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router by sending a specially crafted URL to an authenticated victim. The victim must visit this URL for the router to reboot.
Risk Assessment
The risk involves potential network disruption by remotely forcing a router reboot, leading to service unavailability for users. The attack does not require attacker authentication, only tricking an authenticated user into clicking a link.
Recommendation
It is recommended to immediately update the D-Link DIR-X1860 router firmware to version v1.10WWB09_Beta or later. Until updated, avoid clicking suspicious links and consider restricting access to the admin panel.
Other vulnerabilities in D-Link DIR-X1860
See all- CVE-2021-41445Medium
A reflected cross-site scripting (XSS) vulnerability exists in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta. A remote unauthenticated attacker can execute code on the victim's device by sending a crafted URL to the victim.
- CVE-2021-41442High
An HTTP smuggling vulnerability in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to perform a DoS attack by sending a specially crafted HTTP packet.
Original NVD description (English source)
A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL, for the router to reboot.