CVE-2021-40655
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
The D-Link DIR-605 B2 router allows attackers to steal usernames and passwords by sending a fake request to a specific page. This is critical because it gives attackers full access to control your router.
An authentication bypass vulnerability in D-Link DIR-605 B2 (firmware 2.01MT) allows unauthenticated attackers to retrieve sensitive configuration data including credentials via a forged POST request to /getcfg.php. The vulnerability requires network access to the router's web interface but no prior authentication, leading to complete credential compromise and device takeover.
The full analysis of this CVE is available in Portuguese →