CVE-2021-45382 is a remote code execution vulnerability in D-Link Multiple Routers. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 April 2022, which means attackers have used it in real attacks. A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
What makes this router RCE dangerous
A remote code execution flaw in a router is dangerous because the device sits at a high-trust boundary between the internet and internal networks. If an attacker can reach the vulnerable DDNS function and trigger code execution, they may gain control over the router itself, not just a single user session.
That matters because routers often mediate traffic, DNS behavior, remote management, and logging. Once compromised, they can be used to redirect traffic, open paths deeper into the network, or hide follow-on activity behind a trusted perimeter device.
How exposure is usually assessed
For a CVE like this, exposure starts with knowing exactly which router models and hardware revisions are present, where they are deployed, and whether the vulnerable DDNS feature is enabled or reachable. Internet-facing management, exposed admin portals, and unmanaged branch devices are the first places to check.
Organizations should also compare their inventory against the vendor advisory and the NIST National Vulnerability Database entry for the CVE, then confirm whether the affected devices are actually reachable from untrusted networks. A record in the CVE Program establishes the vulnerability identifier, while the vendor notice is the authoritative source for product-specific remediation details.
At scale, this is the same discipline reflected in NHIMG’s Vulnerability Management Guide: identify the asset, confirm exposure, then prioritize by real exploitability rather than by the CVE label alone.
Remediation and compensating controls
When a patch cannot be applied immediately, the practical goal is to reduce the attack surface around the DDNS path and the router’s administrative interface. That usually means removing internet exposure, restricting management to trusted networks, disabling unused remote features, and isolating the device from sensitive internal segments where possible.
Because routers sit on a critical trust boundary, compensating controls should be treated as temporary risk reduction, not a substitute for vendor remediation. If the device supports it, configuration hardening and access restriction can buy time, but they do not eliminate the underlying code execution condition.
For a broader view of how attacker use of router and appliance flaws can cascade into credential theft, persistence, and network pivoting, see NHIMG’s State of NHI & AI Agent Breach Report 2026, which shows how initial compromise often becomes a platform for deeper abuse.
Detection and post-patch review
Detection should focus on signs that the router executed unexpected commands or changed behavior after suspicious requests to the DDNS-related path. Relevant indicators can include unusual outbound connections, new services, altered configuration, unexplained reboots, and traffic redirection that does not match the approved network design.
After remediation, organizations should review the device as if it may have been used as a staging point. That means validating configuration integrity, checking for persistence mechanisms, and reviewing downstream logs for evidence of lateral movement or traffic manipulation that may have occurred before the patch was applied.
NHIMG’s Gladinet Hard-Coded Keys RCE Exploitation is a useful companion example of how an RCE can turn one product flaw into broader compromise when secrets and trust boundaries are abused.
Risk and Threat Considerations
This vulnerability is especially serious because it affects routers, which often sit at the edge of the network and are trusted to forward traffic correctly. Once attacker code runs there, the impact can extend beyond the device itself into routing, visibility, and the confidentiality of downstream systems.
Failure mechanism: A reachable DDNS code path lets an attacker trigger execution in the router process, then use that foothold to change configuration, intercept traffic, or establish persistence on a highly trusted asset.
Impact: Compromise can expose internal services, enable traffic redirection or surveillance, and give attackers a durable foothold that is harder to detect than compromise of a single endpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Router RCE requires timely vulnerability remediation and exposure review. |
| AC-17 — Remote Access | Internet-facing router management and DDNS exposure hinge on remote access restrictions. | |
| Recommendation — Track and remediate the router flaw quickly, then verify affected assets are updated or isolated. Restrict remote administration paths and limit management to approved networks and users. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE demands asset-aware scanning, prioritization, and remediation tracking. |
| CIS-12 — Network Infrastructure Management | Router compromise directly concerns secure configuration and control of network infrastructure. | |
| Recommendation — Continuously identify affected routers, prioritize exposure, and confirm remediation outcomes. Harden router configuration, remove unnecessary services, and manage changes to edge devices. | ||
| NIST CSF 2.0 | PR.IR-01 — Networks and environments are protected from unauthorized access and use | An exploited router can undermine boundary protection and network trust. |
| Recommendation — Protect edge devices with segmented access and reduce unnecessary exposure to the internet. | ||
Practitioner Guidance
Why practitioners should care: Router CVEs are not just edge-device bugs, they are trust-boundary failures. If a WAN-facing router is exploitable, the business impact can include service disruption, covert traffic manipulation, and a pathway into more sensitive systems.
What to watch for: Treat any unexplained configuration drift, unusual DNS behavior, or unexpected outbound activity from the router as a priority investigation signal. For this class of issue, the safest operational assumption is that exploitation may have occurred before the device was patched.
Practitioner takeaway: Inventory the exposed routers first, then verify whether the vulnerable function is reachable and whether the device needs post-remediation compromise review, not just patching.