CVE-2021-40655

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 86,7%

Kerentanan Incorrect Authorization pada dlink dir-605l firmware. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 16 Mei 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

Rincian

Terbit di NVD

24 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

86,7% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

D-Link DIR-605 Router Information Disclosure Vulnerability

Masuk KEV

16 Mei 2024

Tenggat CISA

6 Juni 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.dlink.com/en/security-bulletin/ advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655 pemerintah AS
• https://github.com/Ilovewomen/D-LINK-DIR-605/ exploit · advisory pihak ketiga