Deviceways

Wireless access point

D-Link DAP-2660

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Qualcomm Atheros QCA9558
Get OpenWrt firmware Release listed · 25.12.6
A1
Get firmware Release listed · 25.12.5
Qualcomm Atheros QCA9558; Qualcomm Atheros QCA9557
Open hardware record
Original project github.com

Recorded configuration: 16 MB flash; 128 MB RAM

First installation
GUI OEM
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

d-link dap-2660 a1 — device documentation (github.com)

Hardware revision
A1,A2

Device details

D-Link DAP-2660 rev A1 — TechInfoDepot (github.com)

Hardware revision
rev A1

Device details

D-Link DAP-2660 rev A1 — WikiDevi (github.com)

Hardware revision
A1

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
A1 / A2

OpenWrt · Qualcomm Atheros QCA9558

OpenWrt · Qualcomm Atheros QCA9558 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM
Availability recorded by source
Available 2022

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 7.5 (v3.1)

D-Link DAP-2660

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier,…

CVE-2022-38873

Affected firmware
DAP-2660: v1.15rc093 and earlier
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.

CVE published

D-Link DAP-2660

D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6

CVE-2023-39750

Affected firmware
DAP-2660: v1.13 was discovered to
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability is exploited via a crafted POST request.

CVE published

D-Link DAP-2660

D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource

CVE-2023-39749

Affected firmware
DAP-2660: v1.13 was discovered to
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource. This vulnerability is exploited via a crafted GET request.

CVE published

D-Link DAP-2660

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100,…

CVE-2021-28840

Affected firmware
DAP-2660: 1.13.RC074
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_config function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the content in upload_file variable is NULL in the upload_config function then the strncasecmp would take NULL as first argument, and incur the NULL pointer dereference vulnerability.

CVE published

D-Link DAP-2660

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100,…

CVE-2021-28839

Affected firmware
DAP-2660: 1.13.RC074
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074, DAP-2690 3.16.RC100, DAP-2695 1.17.RC063, DAP-3320 1.01.RC014 and DAP-3662 1.01.RC022 in the upload_certificate function of sbin/httpd binary. When the binary handle the specific HTTP GET request, the strrchr in the upload_certificate function would take NULL as first argument, and incur the NULL pointer dereference vulnerability.

Check more security advisories for this device · CVE.org