Path Traversal Vulnerability in D-Link DIR-2640 Router

CVE-2021-20134

Summary

The D-Link DIR-2640 router, specifically versions 1.11B02 and earlier, is susceptible to a path traversal vulnerability linked to Quagga Services. This vulnerability enables an authenticated remote attacker to manipulate log files on the device's filesystem. By setting an arbitrary file as the log for either the zebra or ripd services, attackers can inject malicious content, potentially leading to remote code execution. Once the malicious payload is appended, it may allow attackers to escalate privileges and obtain a root shell on the device, presenting a serious security risk.

References