CVE-2021-40655: D-Link DIR-605 Router Information Disclosure Vulnerability
Vulnerability summary
CVE-2021-40655 is a high (CVSS 7.5) Incorrect Authorization vulnerability in D-Link DIR-605 Router. It is known to be exploited: CISA lists it, first on 16-05-2024. EPSS estimates a 86.66% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 24-09-2021PublishedVulnerability first disclosed.
- 16-05-2024Added to CISA KEVD-Link DIR-605 Router Information Disclosure Vulnerability
- 06-06-2024CISA remediation dueApply mitigations per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
86.66%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 86.66% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 16-05-2024
- Federal due date
- 06-06-2024
CISA required action
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions. legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5 nvd.nist.gov/vuln/detail/CVE-2021-40655
Public exploits
1 foundD Link Dir 605
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dlink1 product
- dir-605l_firmware2.01mt
1 vendor · 1 product
References
3 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655Government ResourceUS Government Resource