CVE-2021-46315

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters to cause arbitrary command execution. Since CVE-2019-17510 vulnerability has not been patched and improved www/hnap1/control/setwizardconfig.php, can also use line breaks and backquotes to bypass.

• CWE-78

• https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.mdExploit, Third Party Advisory
• https://www.dlink.com/en/security-bulletin/Vendor Advisory
• https://github.com/doudoudedi/DIR-846_Command_Injection/blob/main/DIR-846_Command_Injection1.mdExploit, Third Party Advisory
• https://www.dlink.com/en/security-bulletin/Vendor Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-46309An SQL Injection vulnerability exists in Sourcecodester Empl…9.8
• CVE-2021-46310An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in…6.5
• CVE-2021-46311A NULL pointer dereference vulnerability exists in GPAC v1.1…5.5
• CVE-2021-46312An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5…6.5
• CVE-2021-46313The binary MP4Box in GPAC v1.0.1 was discovered to contain a…5.5
• CVE-2021-46314A Remote Command Execution (RCE) vulnerability exists in HNA…9.8
• CVE-2021-46319Remote Code Execution (RCE) vulnerability exists in D-Link R…9.8
• CVE-2021-46320In OpenZeppelin <=v4.4.0, initializer functions that are inv…7.5
• CVE-2021-46321Tenda AC Series Router AC11_V02.03.01.104_CN was discovered …9.8
• CVE-2021-46322Duktape v2.99.99 was discovered to contain a SEGV vulnerabil…5.5
• CVE-2021-46323Espruino 2v11.251 was discovered to contain a SEGV vulnerabi…5.5
• CVE-2021-46324Espruino 2v11.251 was discovered to contain a stack buffer o…7.8