CVE-2021-21913 Hardcoded credentials in D-Link
Hardcoded credentials in the MQTT service allow attackers to execute commands and disclose information on D-Link DIR-3040 routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21913?
CVE-2021-21913 is a critical vulnerability in D-Link, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability.
Weakness: CWE-798
Which versions are affected by CVE-2021-21913?
It affects 1 product.
Products include Dlink Dir-3040 Firmware.
How do I fix CVE-2021-21913?
No fix has been published for CVE-2021-21913 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21913 being exploited?
There is no known exploitation of CVE-2021-21913 in the wild and no public exploit code.
Other vulnerabilities in D-Link
- CVE-2021-21820 Hardcoded credentials in D-Link
- CVE-2022-44832 Command injection in n/a
- CVE-2021-21819 Command injection in D-Link
- CVE-2023-41229 D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2022-43648 Memory corruption in DIR-3040
Sources
Also known as GHSA-22wh-wq8h-xvf8.