PT-2021-4897 · D Link · D-Link Dir-605L

Ilovewomen · Published 2021-09-03 · Updated 2025-11-10 · CVE-2021-40655

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-LINK-DIR-605 B2 Firmware version 2.01MT

Description An information disclosure issue exists, allowing an attacker to obtain a user name and password by forging a post request to the "getcfg.php" page. This is due to insufficient protection of registration data, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For D-LINK-DIR-605 B2 Firmware version 2.01MT, consider disabling access to the "getcfg.php" page as a temporary workaround until a patch is available. Restricting access to this page can minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Incorrect Authorization

Weakness Enumeration

CWE-522

CWE-863

Related Identifiers

BDU:2021-05632

CVE-2021-40655

Affected Products

D-Link Dir-605L

References · 24

• 🔥 https://github.com/Ilovewomen/D-LINK-DIR-605 · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40655 · Security Note
• https://bdu.fstec.ru/vul/2021-05632 · Security Note
• https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40655 · Vendor Advisory
• https://t.me/cveNotify/142289 · Telegram Post
• https://twitter.com/AnonOzzyDude/status/1987900454890561546 · Twitter Post
• https://t.me/cibsecurity/29408 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655 · Note
• https://twitter.com/patchnow24x7/status/1792030563349729684 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1931410843062894672 · Twitter Post
• https://twitter.com/pinakinit1/status/1792918325825020147 · Twitter Post
• https://t.me/cvenotify/90645 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1791135109967729135 · Twitter Post