CVE-2021-40655 D-Link DIR-605 Router Information Disclosure
An attacker can obtain user credentials by forging a POST request to the getcfg.php page on D-Link DIR-605 B2 routers.
- Exploited in the wild
- Since 16 May 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40655?
CVE-2021-40655 is a high-severity vulnerability in Dlink Dir-605l Firmware, published on 24 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Weakness: CWE-863
Which versions are affected by CVE-2021-40655?
It affects 1 product.
Products include Dlink Dir-605l Firmware.
How do I fix CVE-2021-40655?
No fix has been published for CVE-2021-40655 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Jun 2024.
Is CVE-2021-40655 being exploited?
Yes. Attackers have exploited CVE-2021-40655 in the wild since at least 16 May 2024.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Dlink Dir-605l Firmware
Sources
Also known as GHSA-95fh-63xw-wfh3.