CVE-2021-41445

MediumCVSS 6.1

Published: 10/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.84%

76th percentile - higher than 76% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta. A remote unauthenticated attacker can execute code on the victim's device by sending a crafted URL to the victim.

Risk Assessment

The risk includes potential session hijacking, credential theft, or malicious actions within the router's management interface context.

Recommendation

Immediately update the D-Link DIR-X1860 firmware to version v1.10WWB09_Beta or later. Until updated, avoid clicking suspicious links and restrict access to the administrative interface.

Original NVD description (English source)

A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to execute code in the device of the victim via sending a specific URL to the unauthenticated victim.