CVE-2021-45382VulnerabilityPublished 04/04/2022Updated 10/24/2026

CVE-2021-45382: D-Link Multiple Routers Remote Code Execution Vulnerability

Affects D-Link Multiple RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/04/2022
KEV deadline: 04/25/2022
EPSS: 97.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

nvd.nist.gov/vuln/detail/CVE-2021-45382 (opens in a new tab)

Description

CVE-2021-45382 is a remote code execution vulnerability affecting multiple D-Link router models across all hardware revisions. The flaw exists in the DDNS function within the ncc2 binary file. This vulnerability has been exploited in the wild, posing a high risk to affected devices.

Summary

This vulnerability allows remote attackers to execute arbitrary code on multiple D-Link routers by exploiting the DDNS function in the ncc2 binary. It affects all hardware revisions of these routers. The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation has been observed in the wild, indicating active threat usage.

Impact

Successful exploitation enables remote code execution on affected routers, potentially allowing attackers to take full control of the device. This can lead to network compromise, interception of traffic, or further attacks within the network environment.

Mitigation

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the DDNS function if possible or isolating affected devices to reduce exposure.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:25:37 UTC

Weaknesses

References

Related threats