CVE-2021-40655
high · 7.5Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Added 2024-05-16Remediation due 2024-06-06
A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
7.5
CVSS
86.7%
EPSS (exploit prob.)
100th
EPSS percentile
2021-09-24
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| dlink | dir-605l_firmware | 2.01mt |
| dlink | dir-605l | b2 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-40655