Information Disclosure Vulnerability in D-Link DIR-605 B2 Firmware
CVE-2021-40655

7.5HIGH

Key Information:

Vendor
D-Link
Status
Dir-605l Firmware
Vendor
CVE Published:
24 September 2021

Badges

👾 Exploit Exists🦅 CISA Reported

Summary

An information disclosure vulnerability exists in the D-Link DIR-605 B2 firmware that allows unauthorized access to sensitive user data. By exploiting this flaw, an attacker can create a forged POST request to the /getcfg.php endpoint, leading to the exposure of usernames and passwords. This vulnerability highlights the importance of proper input validation and security measures for web interfaces, especially in networking devices.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

References

https://www.dlink.com/en/security-bulletin/
x_refsource_MISC
https://github.com/Ilovewomen/D-LINK-DIR-605/
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.