CVE-2021-34203

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Initialization of a Resource with an Insecure Default pada dlink dir-2640-us firmware. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify routing information, monitor the traffic of all devices under the router, hijack DNS and phishing attacks. In addition, this interface is likely to be questioned by customers as a backdoor, because the interface should not be exposed.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.dlink.com/en/security-bulletin/ advisory vendor
• https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34203 exploit · advisory pihak ketiga