CVE-2021-46381: D-Link DAP-1620 path traversal allows local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely exploitable without authentication, has public exploit references, and a high EPSS score, though it is not in CISA KEV and only affects confidentiality.

What it is

D-Link DAP-1620 firmware is affected by a path traversal flaw (CWE-22) that permits local file inclusion, allowing an attacker to read internal files such as /etc/passwd and /etc/shadow. The vulnerability is remotely reachable without authentication or user interaction, making exposed devices a direct information-disclosure risk.

Impact

An attacker can read sensitive system files including /etc/passwd and /etc/shadow, exposing account and credential material that can support further attacks. The CVSS vector indicates high confidentiality impact with no integrity or availability impact.

Attack surface

Reached over the network via the device's web interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication or user interaction is required. The description does not specify the exact endpoint or parameter, so the precise request path is not documented in this record.

Exploitation

Public exploit references are present (PacketStorm and a Google Drive link tagged Exploit), and EPSS is high at 0.58882 (99th percentile), though the CVE is not listed in CISA KEV. No ransomware group usage is documented.

What to do

• Apply the latest D-Link firmware for DAP-1620 per the vendor security bulletin; if no fixed firmware exists, retire or replace the device.
• Remove DAP-1620 management interfaces from internet exposure and restrict access to a trusted management network.
• Place affected devices behind a firewall or reverse proxy that blocks path traversal patterns in request paths.
• Monitor D-Link security bulletins for updated guidance and affected firmware versions.
• If the device cannot be patched or isolated, disable remote management features where possible.

Detection

• Inspect web server or proxy logs for requests containing traversal sequences such as ../, ..%2f, or encoded variants targeting file paths like /etc/passwd or /etc/shadow.
• Alert on HTTP requests to the DAP-1620 management interface from untrusted or external source IPs.
• Monitor for anomalous reads of sensitive system files on or from the device where host-level logging is available.
• Track outbound connections from the device to unknown hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.