CVE-2021-45382

D-Link routers shipped with a remote code execution flaw in the DDNS function that was actively exploited in the wild.

D-Link routers contained an RCE vulnerability in the ncc2 binary via the DDNS function, allowing attackers to execute arbitrary code remotely. This is a critical failure for DIB organizations because it enables lateral movement and data exfiltration, directly impacting CMMC/NIST 800-171 compliance by violating system integrity and access control requirements. Organizations must ensure all network hardware is patched and monitored for known KEV vulnerabilities.

Shame score — D-Link repeatedly shipped consumer-grade firmware with critical RCE flaws that were actively exploited in the wild, demonstrating a pattern of negligence and avoidable risk to the supply chain.