CVE-2021-44127

Name of the Vulnerable Software and Affected Versions DLink DAP-1360 F1 versions <=v6.10

Description The issue allows an attacker to execute arbitrary system commands using the file parameter when it is set to name=deleteFile after authorization. This is related to the "webupg" binary.

Recommendations For DLink DAP-1360 F1 versions <=v6.10, as a temporary workaround, consider restricting access to the "webupg" binary and the file parameter to minimize the risk of exploitation. Avoid using the file parameter with the value name=deleteFile in the affected binary until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.