CVE-2021-39509

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version DIR-816A2 FWv1.10CNB05 R1B011D88210

Description: An issue was discovered where the HTTP request parameter is used in the handler function of the "/goform/form2userconfig.cgi" route. This allows constructing the user name string to delete the user function, leading to command injection through shell metacharacters.

Recommendations: For D-Link DIR-816 version DIR-816A2 FWv1.10CNB05 R1B011D88210, as a temporary workaround, consider restricting access to the "/goform/form2userconfig.cgi" route until a patch is available. Avoid using the username parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.