CVE-2021-45382: D-Link Multiple Routers Remote Code Execution Vulnerability

CVE-2021-45382 is a remote code execution vulnerability affecting multiple D-Link routers. It involves the DDNS function in the ncc2 binary and can allow an attacker to run commands on the device. Because these products are end-of-life, the practical risk is high for any still-connected units: a compromised router can expose the internal network, intercept traffic, or serve as a foothold for further intrusion. Confirm all product and revision details against the vendor advisory and CISA guidance.

How it works

The weakness is classified as CWE-78 (OS Command Injection). In this class of flaw, input that reaches a system command is not properly sanitized, so an attacker can inject additional commands that the device executes with the privileges of the vulnerable process.

According to the CISA summary, the issue exists via the DDNS function in the ncc2 binary across all series hardware revisions of the affected routers. An attacker who can reach that function—typically over the network—can abuse it to achieve remote code execution. Exact request format, authentication requirements, and exploit mechanics are not detailed here; treat any internet-facing or poorly segmented management/DDNS interface as potentially reachable and verify behavior only against the official advisory.

Am I affected? How to find it in your systems

D-Link consumer and small-office routers commonly sit at the network edge as the default gateway, providing WAN, Wi-Fi, and sometimes VPN or DDNS services. Inventory every D-Link device still in production or lab use.

• Check device labels, admin web UI, or SNMP/CLI for model and hardware revision; the advisory states the issue affects all series H/W revisions of the impacted routers.
• Query asset-management, network-discovery, or DHCP logs for D-Link OUI MAC prefixes and known model strings.
• Identify units that still expose management, DDNS, or related services to untrusted networks.
• Review logs for unexpected reboots, unfamiliar outbound connections, new admin accounts, or changes to DDNS/DNS settings—common post-exploitation signs on this class of device. Specific IoCs are not provided in the given facts; correlate with vendor and CISA updates.

Because the products are end-of-life, assume no further security fixes will be issued and treat any remaining unit as high priority for removal.

How to remediate

CISA’s required action is clear: the impacted product is end-of-life and should be disconnected if still in use. Replacement with a supported router is the primary remediation.

• Schedule immediate decommissioning of affected D-Link units; migrate WAN, Wi-Fi, and any DDNS or port-forwarding configuration to a currently supported platform.
• After removal, factory-reset the old device before disposal or recycling so residual credentials and configuration are cleared.
• If a vendor advisory still lists a firmware update for a specific model, apply it only after confirming the model is not fully EOL; otherwise do not rely on patching.
• Harden the replacement: disable unused remote-management and DDNS features, enforce strong unique admin credentials, restrict management to a dedicated internal segment or VPN, and keep firmware current.

If you can't patch immediately

When immediate replacement is impossible, reduce exposure until the device can be removed.

• Disconnect the router from the internet or place it behind a supported firewall that blocks inbound access to management, DDNS, and any other unnecessary services.
• Disable the DDNS function and any related remote-access features in the admin interface if the UI still allows it.
• Segment the device so it cannot reach sensitive internal hosts; treat its LAN as untrusted.
• Apply network-level filtering or virtual patching (firewall/WAF/IDS rules) that restrict or alert on anomalous traffic to the router’s services—rules must be validated against your environment and the advisory.
• Increase monitoring: alert on configuration changes, new outbound connections, and authentication failures. Plan the cut-over to a supported device as soon as possible; compensating controls are temporary.

If your data may have been exposed

Actively exploited edge vulnerabilities frequently lead to network compromise and data exposure. If these routers were internet-facing or showed signs of intrusion, assume credentials, traffic, or internal hosts may have been at risk; rotate passwords, review connected systems, and follow your incident-response process. You can run a free exposure scan of your email addresses against known breach data to check whether associated accounts appear in public breach corpora.