{"id":"CVE-2021-40655","kind":"vulnerability","aliases":["CVE-2021-40655"],"related":[],"title":"dlink dir-605l firmware: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT","description":"D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.\n\nCISA required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","summary":"The D-Link DIR-605 router exposes its stored username and password through a forged POST request to /getcfg.php. An attacker who can reach the router can read the admin credentials and log in.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2024-05-16T00:00:00+00:00","products":[{"name":"D-Link DIR-605 Router","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink dir-605l firmware","fixed":[],"affected":"= 2.01mt","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","dir-605","exploited","infrastructure","routers","self-hosted"],"not_affected_if":["no-dir-605-in-use"],"how_to_check":"Check whether any DIR-605 router is on your network or internet-facing, and confirm the model and hardware revision on its label or admin page.","fix":"Retire and replace the device, since all DIR-605 hardware revisions are end-of-life and no vendor fix is stated in the sources.\nChange the router's admin password if it cannot be replaced immediately.","status":"open","published_at":"2021-09-24T21:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:42+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:00:42Z","model":"claude-haiku-5-5","output":{"fix":"Retire and replace the device, since all DIR-605 hardware revisions are end-of-life and no vendor fix is stated in the sources.\nChange the router's admin password if it cannot be replaced immediately.","reach":"network","impact":"high","summary":"The D-Link DIR-605 router exposes its stored username and password through a forged POST request to /getcfg.php. An attacker who can reach the router can read the admin credentials and log in.","category":"infrastructure","who_cares":["d-link","dir-605","self-hosted","routers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads router username and password, then takes admin control","analyst_note":"Confirm the affected firmware versions and whether a vendor patch exists, using the D-Link advisory or the NVD entry for CVE-2021-40655.","how_to_check":"Check whether any DIR-605 router is on your network or internet-facing, and confirm the model and hardware revision on its label or admin page.\nunknown","needs_analyst":true,"not_affected_if":["no-dir-605-in-use"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":2864,"output_tokens":407,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':23A,26A '-40655':24A,27A '-605':32A,43B,55B,88C '/getcfg.php':69B,111C '2.01':20A '605':16A '605l':4A,37A 'action':115C 'admin':80B 'affect':118C 'allow':96C 'associ':125C 'attack':71B,97C 'b2':17A 'cisa':113C 'contain':90C 'credenti':81B 'cve':22A,25A 'cycl':143C 'd':13A,29A,40B,52B,85C,121C 'd-link':28A,39B,51B,84C,120C 'd-link-dir':12A 'dir':3A,15A,31A,36A,42B,54B,87C 'dir-605l':2A,35A 'disclosur':8A,93C 'dlink':1A,34A 'end':132C,138C 'end-of-lif':131C 'end-of-servic':137C 'eo':141C 'eol':135C 'exist':10A 'exploit':44B 'expos':57B 'firmwar':5A,18A 'firmware':38A 'forg':65B,105C 'hardwar':126C 'host':49B 'inform':92C 'informt':7A 'infrastructur':45B 'instruct':152C 'issu':9A 'legaci':119C 'life':134C,142C 'link':14A,30A,41B,53B,86C,122C 'log':83B 'mt':21A 'obtain':99C 'page':112C 'password':62B,103C 'per':150C 'post':66B,107C 'product':123C 'reach':74B,129C 'read':78B 'replac':149C 'request':67B,108C 'requir':114C 'retir':147C 'revis':127C 'router':33A,46B,56B,76B,89C 'self':48B 'self-host':47B 'servic':140C 'store':59B 'usernam':60B,101C 'vendor':151C 'version':19A 'vulner':94C,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-24T21:15:07+00:00","kev":{"dateAdded":"2024-05-16","dueDate":"2024-06-06","requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-40655","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40655","severity":null,"published_at":"2024-05-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-40655","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40655","severity":null,"published_at":"2021-09-24T21:15:07+00:00","modified_at":"2026-06-17T04:07:13+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}