CVE-2021-21816
published 2021-07-16CVE-2021-21816: An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the…
PriorityP340medium4.3CVSS 3.1
AVNACLPRNUIRSUCLINAN
EXPLOIT
EPSS
36.49%
98.3th percentile
An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-3040_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/messages
snort↗
57475 - 57478
- →HTTP GET request to /messages endpoint on the target device; response body containing all three strings 'syslog:', 'admin', and '/etc_ro/lighttpd/www' with HTTP 200 status indicates successful exploitation/exposure of the syslog information disclosure vulnerability.
- →The vulnerability is triggered via a specially crafted HTTP GET request to the Syslog functionality endpoint; no authentication required (PR:N) and the response leaks system log contents. ↗
- ·Snort rules 57475–57478 cover the broader set of D-LINK DIR-3040 vulnerabilities (CVE-2021-21816 through related CVEs); individual rule-to-CVE mapping is not specified in the source. ↗
- ·Affected version is specifically D-LINK DIR-3040 firmware 1.13B03; Talos confirmed exploitation only against this version. ↗
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
D-Link DIR-3040 1.13B03 - Information Disclosure
nuclei·CVSS 4.3
CVE-2021-21816 [MEDIUM] D-Link DIR-3040 1.13B03 - Information Disclosure
D-Link DIR-3040 1.13B03 - Information Disclosure
D-Link DIR-3040 1.13B03 is susceptible to information disclosure in the Syslog functionality. A specially crafted HTTP network request can lead to the disclosure of sensitive information. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
Template:
id: CVE-2021-21816
info:
name: D-Link DIR-3040 1.13B03 - Information Disclosure
author: gy741
severity: medium
description: D-Link DIR-3040 1.13B03 is susceptible to information disclosure in the Syslog functionality. A specially crafted HTTP network request can lead to the disclosure of sensitive information. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or ex
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
## The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
Since the discovery of the widespread VPNFilter malware in 2018 , Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
There are several Snort rules that can detect possible exploitation of the vulnerabilitie
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
- Since the discovery of the widespread VPNFilter malware in 2018, Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
- During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
- Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
- There are several Snort rules that can detect possible exploitation of the vulnerabilities included in this post.
Small office/home office (SOHO) routers and small-scale industrial rout
Talos
Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
blogs_talos·2021-07-15·CVSS 4.3
[MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
## Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router.
The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a variety of malicious actions, including exposing sensitive information, causing a denial of service and gaining the ability to execute arbitrary code. TALOS-2021-1281 (CVE-2021-21816) and TALOS-2021-1282 (CVE-2021-21817) are information disclosure vulnerabilities in the router that could be triggered by a specially crafted network request. An attacker could exploit these vulnerabilities to view the device’s system log.
TALOS-2021-1283
Talos
Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
blogs_talos·2021-07-15·CVSS 4.3
CVE-2021-21816 [MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router.
The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a variety of malicious actions, including exposing sensitive information, causing a denial of service and gaining the ability to execute arbitrary code. TALOS-2021-1281 (CVE-2021-21816) and TALOS-2021-1282 (CVE-2021-21817) are information disclosure vulnerabilities in the router that could be triggered by a specially crafted network request. An attacker could exploit these vulnerabilities to view the device’s system log.
TALOS-2021-1283 (CVE-2021-21818) and TALOS-2021-1285 (CVE-2021-21820) are both hardcoded
2021-07-16
Published