{"id":"CVE-2021-45382","kind":"vulnerability","aliases":["CVE-2021-45382"],"related":[],"title":"D-Link Multiple Routers: D-Link Multiple Routers Remote Code Execution Vulnerability","description":"A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life (\"EOL\") /End of Service Life (\"EOS\") Life-Cycle and as such this issue will not be patched.","summary":"D-Link routers on all series H/W revisions have a remote code execution flaw in the DDNS function of the ncc2 binary. An attacker on the internet can run commands on the router without logging in.","severity":"critical","cvss":10.0,"epss":0.97836,"exploited":true,"exploited_at":"2022-04-04T00:00:00+00:00","products":[{"name":"D-Link Multiple Routers","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","exploited","infrastructure","routers","self-hosted"],"not_affected_if":["no-ddns-enabled","not-d-link"],"how_to_check":null,"fix":"Disconnect the affected D-Link router if still in use, since the vendor product is end-of-life and no patch is named in the sources.","status":"open","published_at":"2022-02-17T21:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:18:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:18:08Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the affected D-Link router if still in use, since the vendor product is end-of-life and no patch is named in the sources.\nunknown","reach":"internet","impact":"high","summary":"D-Link routers on all series H/W revisions have a remote code execution flaw in the DDNS function of the ncc2 binary. An attacker on the internet can run commands on the router without logging in.","category":"infrastructure","who_cares":["d-link","routers","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs commands on the router remotely, pivoting into the internal network.","analyst_note":"Find the affected D-Link model list and any vendor firmware or EOL notice; the KEV entry gives no versions or DDNS-enabled default details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-d-link","no-ddns-enabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00046,"input_tokens":2838,"output_tokens":353,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,19A '-45382':17A,20A '/end':138C '/lw':92C '810l':88C,115C '820l':91C,118C '826l':95C,124C '830l':98C,121C '836l':102C,127C 'attack':59B 'binari':57B,110C 'code':12A,47B 'command':65B,73C 'cve':15A,18A 'cycl':145C 'd':2A,7A,22A,27B,36B,84C 'd-link':1A,6A,21A,26B,35B,83C 'ddns':52B,106C 'dir':87C,90C,94C,97C,101C,114C,117C,120C,123C,126C 'dir-810l':86C,113C 'dir-820l':89C,116C 'dir-826l':93C,122C 'dir-830l':96C,119C 'dir-836l':100C,125C 'end':134C 'eo':142C 'eol':137C 'execut':13A,48B,74C 'exist':77C 'exploit':29B 'file':111C 'flaw':49B 'function':53B,107C 'h/w':42B,81C 'hardwar':129C 'host':34B 'infrastructur':30B 'internet':62B 'issu':150C 'life':136C,141C,144C 'life-cycl':143C 'link':3A,8A,23A,28B,37B,85C 'log':70B 'multipl':4A,9A 'multiple':24A 'ncc2':56B,109C 'note':112C 'patch':154C 'rce':75C 'reach':132C 'remot':11A,46B,72C 'revis':43B,82C,130C 'router':5A,10A,31B,38B,68B,103C 'routers':25A 'run':64B 'self':33B 'self-host':32B 'seri':41B,80C 'servic':140C 'via':104C 'vulner':14A,76C 'without':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-17T21:15:07+00:00","kev":{"dateAdded":"2022-04-04","dueDate":"2022-04-25","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-45382","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45382","severity":null,"published_at":"2022-04-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2021-45382","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-45382","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-45382","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45382","severity":null,"published_at":"2022-02-17T21:15:07+00:00","modified_at":"2026-06-17T04:13:19+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}