CVE-2021-29379

An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-78

• https://cool-y.github.io/2021/03/02/DIR-802-OS-Command-InjectionExploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10206Vendor Advisory
• https://www.dlink.com/en/security-bulletin/Vendor Advisory
• https://cool-y.github.io/2021/03/02/DIR-802-OS-Command-InjectionExploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10206Vendor Advisory
• https://www.dlink.com/en/security-bulletin/Vendor Advisory

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29368Session fixation vulnerability in CuppaCMS thru commit 4c9b7…8.8
• CVE-2021-29369The gnuplot package prior to version 0.1.0 for Node.js allow…9.8
• CVE-2021-29370A UXSS was discovered in the Thanos-Soft Cheetah Browser in …6.1
• CVE-2021-29376ircII before 20210314 allows remote attackers to cause a den…7.5
• CVE-2021-29377Pear Admin Think through 2.1.2 has an arbitrary file upload …9.8
• CVE-2021-29378SQL Injection in pear-admin-think version 2.1.2, allows atta…8.8
• CVE-2021-29387Multiple stored cross-site scripting (XSS) vulnerabilities i…5.4
• CVE-2021-29388A stored cross-site scripting (XSS) vulnerability in SourceC…5.4
• CVE-2021-29390libjpeg-turbo version 2.0.90 has a heap-based buffer over-re…7.1
• CVE-2021-29393Remote Code Execution in cominput.jsp and comoutput.jsp in N…9.8
• CVE-2021-29394Account Hijacking in /northstar/Admin/changePassword.jsp in …6.5
• CVE-2021-29395Directory travesal in /northstar/filemanager/download.jsp in…7.5