CVE-2021-28838: D-Link Dap-2310 Firmware

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, DAP-2660 1.15rc131b, DAP-2690 3.20RC115 BETA, DAP-2695 1.20RC093, DAP-3320 1.05RC027 BETA and DAP-3662 1.05rc069 in the sbin/httpd binary. The crash happens at the `atoi' operation when a specific network package are sent to the httpd binary.

Affected products

• D-Link Dap-2310 Firmware: up to and including 2.10rc039
• D-Link Dap-2330 Firmware: before 1.10rc036 (fixed in 1.10rc036); version 1.10rc036 only
• D-Link Dap-2360 Firmware: up to and including 2.10rc055
• D-Link Dap-2553 Firmware: before 3.10rc039 (fixed in 3.10rc039); version 3.10rc039 only
• D-Link Dap-2660 Firmware: up to and including 1.15rc131b
• D-Link Dap-2690 Firmware: before 3.20rc115 (fixed in 3.20rc115); version 3.20rc115 only
• D-Link Dap-2695 Firmware: up to and including 1.20rc093
• D-Link Dap-3320 Firmware: before 1.05rc027 (fixed in 1.05rc027); version 1.05rc027 only
• D-Link Dap-3662 Firmware: before 1.05rc069 (fixed in 1.05rc069); version 1.05rc069 only

Published 2021-08-10. Last modified 2026-06-17.