CVE-2021-45382: D-Link DIR series routers command injection in DDNS function

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active inclusion in CISA KEV, near-maximum EPSS probability, public exploit code, and no vendor patch available make this an urgent risk.

What it is

An OS command injection flaw exists in the DDNS function of the ncc2 binary on multiple D-Link DIR router models (DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, DIR-836L) across all hardware revisions. It allows unauthenticated remote command execution, and D-Link has stated these end-of-life models will not be patched.

Impact

An attacker can execute arbitrary commands on the router, gaining full control of the device and potentially using it as a pivot into the internal network.

Attack surface

The flaw is reachable over the network via the DDNS function with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CVE-2021-45382 is listed in CISA KEV with a due date of 2022-04-25, and EPSS shows a 30-day probability of 0.978 (99.9th percentile); public exploit code is referenced. No ransomware campaign use is documented.

What to do

• Because the affected models are end-of-life and will not be patched, disconnect them from the network and replace with supported hardware.
• If immediate replacement is not possible, block external access to the router management and DDNS interfaces and restrict them to trusted internal hosts only.
• Disable the DDNS feature if it is not required.
• Segment or isolate any remaining affected routers on a separate VLAN with strict outbound filtering.
• Monitor vendor advisory SAP10264 and CISA guidance for any updated instructions.

Detection

• Inspect router logs and network traffic for unexpected outbound connections or command execution tied to the DDNS function.
• Monitor for anomalous processes or shell activity on the router if any host-based telemetry is available.
• Watch for known exploit signatures or requests targeting the ncc2 binary or DDNS endpoints.
• Alert on affected DIR-810L/820L/820LW/826L/830L/836L devices still present on the network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.