CVE-2021-40655
published 2021-09-24CVE-2021-40655: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request…
PriorityP185high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2024-06-06
Exploited in the wild
EPSS
87.04%
99.7th percentile
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-605l_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /getcfg.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie:
X-Forwarded-For: 127.0.0.1
SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a↗
otherfofa-query: body="l_tb>DIR-605"
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DIR-605 getcfg.php Authentication Bypass Attempt (CVE-2021-40655)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:11; content:"/getcfg.php"; http.request_body; content:"SERVICES|3d|DEVICE.ACCOUNT"; fast_pattern; content:"AUTHORIZED_GROUP|3d|1|25|0a"; nocase; reference:url,attackerkb.com/topics/wTT1ZhDWlH/cve-2021-40655/vuln-details; reference:url,github.com/Ilovewomen/D-LINK-DIR-605/; reference:cve,2021-40655; classtype:attempted-admin; sid:2059893; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_02_05, cve CVE_2021_40655, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_02_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →The exploit requires a POST request to /getcfg.php with body parameters SERVICES=DEVICE.ACCOUNT and AUTHORIZED_GROUP=1%0a (URL-encoded newline injection). No authentication cookie is needed.
- →A successful exploitation response returns HTTP 200 with Content-Type text/xml and body containing the string 'DEVICE.ACCOUNT', indicating credential disclosure.
- →The Snort/ET rule detects the attack by matching POST method, URI exactly 11 bytes (/getcfg.php), body containing SERVICES=DEVICE.ACCOUNT and AUTHORIZED_GROUP=1%0a (encoded as |3d| and |25|0a|). SID 2059893.
- →The attack is unauthenticated and targets plaintext HTTP traffic on perimeter and internal network segments (tls_state plaintext).
- →CISA KEV-listed; older vulnerabilities like this are typically leveraged by botnet malware incorporating large lists of exploitable security issues.
- ·Vulnerability only affects D-Link DIR-605 B2 hardware revision running firmware version 2.01MT. All hardware revisions are EOL/EOS and no patch will be issued. ↗
- ·D-Link DIR-605 has been out of support since 2015; CISA's required action is device retirement and replacement, not patching. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-95fh-63xw-wfh3: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2
ghsa_unreviewed·2022-05-24
CVE-2021-40655 [HIGH] CWE-522 GHSA-95fh-63xw-wfh3: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
VulnCheck
D-Link DIR-605 Router Information Disclosure Vulnerability
vulncheck·2021·CVSS 7.5
CVE-2021-40655 [HIGH] CWE-863 D-Link DIR-605 Router Information Disclosure Vulnerability
D-Link DIR-605 Router Information Disclosure Vulnerability
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
Affected: D-Link DIR-605 Router
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack; https://www.forescout.com/resources/2024h1-threat-review/; https://info.greynoise.io/hubfs/resources/GreyNois
CISA
D-Link DIR-605 Router Information Disclosure Vulnerability
cisa·2024-05-16·CVSS 7.5
CVE-2021-40655 [HIGH] CWE-863 D-Link DIR-605 Router Information Disclosure Vulnerability
Vulnerability: D-Link DIR-605 Router Information Disclosure Vulnerability
Affected: D-Link DIR-605 Router
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
Required Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Notes: https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5; https://nvd.nist.gov/vuln/detail/CVE-2021-40655
Remediation Due Date: 2024-06-06
Suricata
ET WEB_SPECIFIC_APPS D-Link DIR-605 getcfg.php Authentication Bypass Attempt (CVE-2021-40655)
suricata·2025-02-05·CVSS 7.5
CVE-2021-40655 [HIGH] ET WEB_SPECIFIC_APPS D-Link DIR-605 getcfg.php Authentication Bypass Attempt (CVE-2021-40655)
ET WEB_SPECIFIC_APPS D-Link DIR-605 getcfg.php Authentication Bypass Attempt (CVE-2021-40655)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link DIR-605 getcfg.php Authentication Bypass Attempt (CVE-2021-40655)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:11; content:"/getcfg.php"; http.request_body; content:"SERVICES|3d|DEVICE.ACCOUNT"; fast_pattern; content:"AUTHORIZED_GROUP|3d|1|25|0a"; nocase; reference:url,attackerkb.com/topics/wTT1ZhDWlH/cve-2021-40655/vuln-details; reference:url,github.com/Ilovewomen/D-LINK-DIR-605/; reference:cve,2021-40655; classtype:attempted-admin; sid:2059893; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_02_05, cve CVE_2021_40655, deploym
Nuclei
D-Link DIR-605 - Information Disclosure
nuclei·CVSS 7.5
CVE-2021-40655 [HIGH] D-Link DIR-605 - Information Disclosure
D-Link DIR-605 - Information Disclosure
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Template:
id: CVE-2021-40655
info:
name: D-Link DIR-605 - Information Disclosure
author: DhiyaneshDK
severity: high
description: |
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
impact: |
Unauthenticated attackers can obtain router credentials including usernames and passwords by exploiting information disclosure in the getcfg.php endpoint.
remediation: |
Apply firmware updates provided by D-Link or replace the device with a supp
2021-09-24
Published
2024-05-16
Added to CISA KEV
Exploited in the wild