Vulnerability record · CVE-2021-27250 · published 14 April 2021
CVE-2021-27250: D-Link DAP-2020 CGI errorpage path traversal credential disclosure
Dlink · Dap 2020 Firmware
The D-Link DAP-2020 Wi-Fi access point fails to validate the user-supplied path in the CGI errorpage request parameter before using it in file operations, allowing a path traversal that discloses stored credentials. The flaw is reachable by network-adjacent attackers without authentication, and the exposed credentials can enable further compromise of the device.
Description
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-11856.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-adjacent credential disclosure with a very high EPSS score, though not observed in KEV and requiring adjacency.
What it is
The D-Link DAP-2020 Wi-Fi access point fails to validate the user-supplied path in the CGI errorpage request parameter before using it in file operations, allowing a path traversal that discloses stored credentials. The flaw is reachable by network-adjacent attackers without authentication, and the exposed credentials can enable further compromise of the device.
Impact
An attacker gains read access to files on the device, including stored credentials, which can be used to escalate to administrative control or pivot into the network.
Attack surface
Reached over the network from an adjacent position (AV:A) via the CGI errorpage request parameter; no authentication (PR:N) and no user interaction (UI:N) are required.
Exploitation
Not listed in CISA KEV, but EPSS is high at 0.674 (99.3rd percentile), indicating elevated likelihood of exploitation activity; references are vendor patch and ZDI advisory only, with no public exploit tag.
What to do
- Apply the D-Link vendor patch referenced in SAP10201 as the first action.
- Restrict network access to the DAP-2020 management/CGI interface to trusted administrative segments only.
- Change default and stored credentials on the device and any accounts whose credentials may reside on it.
- Monitor the device for unexpected file-read requests to CGI endpoints and for signs of follow-on compromise.
Detection
- Inspect HTTP requests to the DAP-2020 CGI errorpage parameter for traversal sequences such as ../ or encoded variants.
- Alert on anomalous reads of credential or configuration files by the web/CGI process.
- Review device and adjacent-network logs for unauthenticated access attempts to CGI endpoints from unexpected hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-205/ | Third Party AdvisoryVDB Entry |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201 | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-205/ | Third Party AdvisoryVDB Entry |
Track CVE-2021-27250 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-27250), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
