Live › vulnerability › CVE-2021-40655
Go to dashboardThe D-Link DIR-605 router exposes its stored username and password through a forged POST request to /getcfg.php. An attacker who can reach the router can read the admin credentials and log in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| D-Link DIR-605 Router | vendor | – | – |
| dlink dir-605l firmware | vendor | = 2.01mt | – |
Check whether any DIR-605 router is on your network or internet-facing, and confirm the model and hardware revision on its label or admin page.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
CISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2021-40655")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.