CVE-2021-28143: D-Link DIR-841 jsonrpc authenticated command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.0 with public exploit code and very high EPSS, though exploitation requires valid credentials and adjacent network access.

What it is

The /jsonrpc endpoint on D-Link DIR-841 firmware 3.03 and 3.04 fails to sanitize input passed to the ping, ping6, and traceroute functions under System Tools, allowing OS command injection. An attacker who already holds valid credentials can run arbitrary commands on the router, which is typically the network edge device.

Impact

An authenticated attacker gains arbitrary command execution on the router with the privileges of the web service, enabling full device compromise, configuration changes, and use of the router as a pivot into the internal network.

Attack surface

Reached over the adjacent network via the router's web management interface (/jsonrpc); the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so valid credentials are needed.

Exploitation

No CISA KEV listing and no ransomware association; EPSS is 0.457 (98.7th percentile), and the advisory references are tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Apply the D-Link vendor patch referenced in SAP10207 for DIR-841 firmware.
• If patching is not possible, disable remote management and restrict administrative access to trusted LAN segments only.
• Change default and weak administrative credentials and enforce strong unique passwords on the router.
• Replace end-of-support DIR-841 units that cannot be updated with a supported router.

Detection

• Monitor router and web logs for /jsonrpc requests containing shell metacharacters (;, |, &, $(), backticks) in ping, ping6, or traceroute parameters.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Audit router configuration changes and new admin accounts for signs of post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.