CVE-2021-21820
published 2021-07-16CVE-2021-21820: A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.96%
85.6th percentile
A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-3040_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
57475 - 57478
- →CVE-2021-21820 (TALOS-2021-1285) is a hard-coded password vulnerability in the Libcli Test Environment functionality of D-LINK DIR-3040 firmware version 1.13B03. Exploitation involves sending a sequence of specially crafted network requests to achieve code execution. ↗
- →Exploitation requires a sequence of requests targeting the Libcli Test Environment; monitor for anomalous multi-step network request patterns directed at D-LINK DIR-3040 devices. ↗
- ·Snort rules 57475–57478 are subject to change as additional vulnerability information becomes available; always pull the latest rule versions from Firepower Management Center or Snort.org. ↗
- ·Only D-LINK DIR-3040 firmware version 1.13B03 was confirmed vulnerable and tested by Talos. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
## The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
Since the discovery of the widespread VPNFilter malware in 2018 , Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
There are several Snort rules that can detect possible exploitation of the vulnerabilitie
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
- Since the discovery of the widespread VPNFilter malware in 2018, Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
- During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
- Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
- There are several Snort rules that can detect possible exploitation of the vulnerabilities included in this post.
Small office/home office (SOHO) routers and small-scale industrial rout
Talos
Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
blogs_talos·2021-07-15·CVSS 4.3
[MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
## Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router.
The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a variety of malicious actions, including exposing sensitive information, causing a denial of service and gaining the ability to execute arbitrary code. TALOS-2021-1281 (CVE-2021-21816) and TALOS-2021-1282 (CVE-2021-21817) are information disclosure vulnerabilities in the router that could be triggered by a specially crafted network request. An attacker could exploit these vulnerabilities to view the device’s system log.
TALOS-2021-1283
Talos
Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
blogs_talos·2021-07-15·CVSS 4.3
CVE-2021-21816 [MEDIUM] Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040
Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router.
The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a variety of malicious actions, including exposing sensitive information, causing a denial of service and gaining the ability to execute arbitrary code. TALOS-2021-1281 (CVE-2021-21816) and TALOS-2021-1282 (CVE-2021-21817) are information disclosure vulnerabilities in the router that could be triggered by a specially crafted network request. An attacker could exploit these vulnerabilities to view the device’s system log.
TALOS-2021-1283 (CVE-2021-21818) and TALOS-2021-1285 (CVE-2021-21820) are both hardcoded
2021-07-16
Published