CVE-2021-40655
D-Link DIR-605 Router Information Disclosure Vulnerability
Description
CVE-2021-40655 is a high-severity information disclosure vulnerability in the D-Link DIR-605 router, specifically affecting firmware version 2.01MT on the B2 hardware revision. The flaw allows an unauthenticated remote attacker to obtain valid administrator credentials by sending a specially crafted POST request to the /getcfg.php endpoint on the device's web management interface. With a CVSS v3.1 base score of 7.5, this vulnerability exposes sensitive authentication data without requiring any privileges or user interaction. CISA has added CVE-2021-40655 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 6, 2024, and its EPSS score of 92.61% at the 99.7th percentile confirms that this vulnerability is among the most actively exploited in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-605l firmware | 2.01mt |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/Ilovewomen/D-LINK-DIR-605/(Exploit, Third Party Advisory)
- https://www.dlink.com/en/security-bulletin/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655(US Government Resource)
Weakness Type
Information Disclosure via Unauthenticated Endpoint
CVE-2021-40655 involves an improperly secured configuration endpoint that exposes sensitive credentials to unauthenticated requestors. The /getcfg.php page on the D-Link DIR-605 router returns the device's administrator username and password in response to a forged POST request, without verifying that the requestor has a valid authenticated session. This type of weakness is closely related to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where the application fails to restrict access to sensitive data, and CWE-306 (Missing Authentication for Critical Function), where a critical function lacks proper authentication checks. The combination of these weaknesses means that any network-adjacent or internet-exposed attacker can trivially retrieve full administrative credentials. Learn more about CWE-200
Impact Analysis
The impact of CVE-2021-40655 is concentrated on confidentiality, which receives a high severity rating in the CVSS assessment. An attacker who exploits this vulnerability gains immediate access to the router's administrator username and password, providing complete control over the device's configuration and all connected network traffic. Although the CVSS vector rates integrity and availability as unaffected (I:N/A:N), the practical consequences extend far beyond simple credential disclosure. Once in possession of valid administrative credentials, an attacker can reconfigure DNS settings to redirect traffic to malicious servers, modify firewall rules to enable lateral movement, install persistent backdoors through firmware manipulation, or intercept and monitor all network communications passing through the router.
The EPSS score of 92.61% at the 99.7th percentile places this vulnerability in an extraordinarily high exploitation probability bracket, meaning it is being exploited more aggressively than virtually all other known vulnerabilities. The attack requires no authentication (PR:N), no user interaction (UI:N), and can be executed remotely over the network (AV:N) with low complexity (AC:L). CISA's KEV listing notes the ransomware association as "Unknown," but the trivial nature of exploitation and the value of router compromise for network pivoting make this vulnerability highly attractive to both opportunistic and targeted threat actors.
Exploit Maturity
CVE-2021-40655 has reached maximum exploit maturity. Public proof-of-concept code is freely available on GitHub, providing step-by-step instructions and tools for exploiting the vulnerability. The exploit is trivially simple, requiring only a single crafted HTTP POST request to the /getcfg.php endpoint to retrieve plaintext administrator credentials.
CISA's inclusion of this vulnerability in the Known Exploited Vulnerabilities catalog confirms active exploitation in the wild. The EPSS score of 92.61% at the 99.7th percentile is among the highest possible, indicating that exploitation is not merely theoretical but is occurring at massive scale. The ransomware association is classified as "Unknown" by CISA, but compromised routers are frequently leveraged as entry points for broader network attacks, including ransomware deployment against connected systems. The combination of public exploit availability, trivial exploitation complexity, and confirmed active exploitation makes this one of the most urgent vulnerabilities to address in consumer and small-business networking equipment.
Remediation
-
Immediately isolate affected devices by disconnecting any D-Link DIR-605 B2 routers running firmware version 2.01MT from the internet. If the router must remain operational, restrict management interface access to trusted internal IP addresses only and disable remote management entirely.
-
Check for firmware updates by visiting the D-Link security bulletin page for any available patches or updated firmware for the DIR-605. If an updated firmware version is available, download and install it immediately following D-Link's upgrade procedures.
-
Replace end-of-life hardware if no firmware update is available. The D-Link DIR-605 is a legacy product that may no longer receive security updates. Organizations and individuals should replace it with a currently supported router model that receives regular security patches.
-
Change all credentials associated with the router immediately, including the administrative password and any Wi-Fi pre-shared keys. If the router was internet-exposed, assume that credentials have been compromised and audit all devices on the connected network for signs of unauthorized access.
-
Conduct a network forensic review to determine whether the vulnerability was exploited before mitigation. Check for unauthorized DNS configuration changes, modified firewall rules, new port forwarding entries, or evidence of firmware tampering that could indicate a persistent compromise.
Technical Details
CVE-2021-40655 targets the /getcfg.php endpoint on the D-Link DIR-605 B2 router running firmware version 2.01MT. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, scoring 7.5 as a high-severity vulnerability focused entirely on confidentiality compromise.
The attack mechanism involves sending a crafted POST request to the router's web management interface at the /getcfg.php page. This PHP script is responsible for returning the device's configuration data, including the administrator username and password. Under normal operation, this endpoint should only respond to authenticated sessions with valid session cookies. However, a flaw in the authentication logic allows the endpoint to return sensitive configuration data, including plaintext credentials, to any requester who crafts the appropriate POST parameters, regardless of authentication status.
The Attack Vector (AV:N) confirms that exploitation occurs over the network, meaning any attacker who can reach the router's web interface can exploit the vulnerability. Attack Complexity (AC:L) is low because the exploit requires only a single HTTP request with no race conditions or special prerequisites. Privileges Required (PR:N) is none, as no authentication is needed. User Interaction (UI:N) is none, making this a fully automated attack. The Scope (S:U) is unchanged, meaning the vulnerability is contained to the router itself, though the disclosed credentials enable subsequent attacks on connected resources. Confidentiality (C:H) is high because the full administrative credential set is exposed, while Integrity (I:N) and Availability (A:N) are not directly impacted by the information disclosure itself.
Frequently Asked Questions
What is CVE-2021-40655?
CVE-2021-40655 is an information disclosure vulnerability in D-Link DIR-605 B2 routers with firmware version 2.01MT. It allows unauthenticated attackers to retrieve the administrator username and password by sending a crafted POST request to the /getcfg.php page.
How severe is CVE-2021-40655?
With a CVSS score of 7.5 (High) and an EPSS score of 92.61% at the 99.7th percentile, this is an extremely high-risk vulnerability. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog.
Is my D-Link DIR-605 affected?
If you are running a D-Link DIR-605 B2 with firmware version 2.01MT, your device is affected. The vulnerability specifically targets the /getcfg.php endpoint on this firmware version.
What should I do if I cannot update the firmware?
If no firmware update is available, the recommended action is to replace the D-Link DIR-605 with a currently supported router model. As an interim measure, disable remote management, restrict web interface access to trusted IPs, and change all administrative credentials immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.