CVE-2021-42627

published 2022-08-23

CVE-2021-42627: The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose…

Priority P2 78 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-615_firmware	—	—
dlink	dir-615_j1_firmware	—	—
dlink	dir-615_t1_firmware	—	—
dlink	dir-615jx10_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /wan.htm↗

• → Unauthenticated GET request to /wan.htm returns HTTP 200 with body containing both "src='menu.js?v=\"+Math.random()+\"'>');" and "var ipv6conntype", and response header containing "Virtual Web" — confirms vulnerable D-Link DIR-615 firmware 20.06 exposure. ↗
• → Shodan queries "http.title:\"Roteador Wireless\"" and cpe:"cpe:2.3:h:dlink:dir-615" can be used to identify internet-exposed D-Link DIR-615 devices potentially affected by this vulnerability. ↗

• · Vulnerability is specific to D-Link DIR-615 devices running firmware version 20.06 only. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.