PT-2021-3322 · D Link · D-Link Dir-2640-Us

Liyansong2018 · Published 2021-06-16 · Updated 2024-02-14 · CVE-2021-34203

Positive Technologies (AI Summary)

CVSS v2.0

9.7

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions D-Link DIR-2640-US version 1.01B04

Description The issue is related to Incorrect Access Control in the D-Link DIR-2640-US router. When setting up PPPoE, the router starts the quagga process, which uses the default password and port, allowing an attacker to easily log in using telnet. This enables the attacker to modify routing information, monitor traffic of all devices under the router, hijack DNS, and conduct phishing attacks. The interface in question may be perceived as a backdoor due to its exposure.

Recommendations For D-Link DIR-2640-US version 1.01B04, consider disabling the quagga process or changing the default password and port used by this process to prevent unauthorized access until a patch is available. Restrict access to the telnet interface to minimize the risk of exploitation. Avoid using the default settings for PPPoE configuration to reduce the vulnerability to attacks.

Exploit

Fix

Weakness Enumeration

CWE-1188

CWE-259

Related Identifiers

BDU:2021-03115

CVE-2021-34203

Affected Products

D-Link Dir-2640-Us

References · 8

• 🔥 https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34203 · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03115 · Security Note
• http://d-link.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34203 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34203 · Vendor Advisory
• https://vuldb.com/?id.177186 · Note
• http://dir-2640-us.com · Note