CVE-2021-40655

Timeline

Detection, updates, and resolution for this record.

1. Sep 24, 2021 · Catalog

   Detected

   An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

2. May 16, 2024 · CISA KEV

   Known exploited

   This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

3. Jun 6, 2024 · CISA KEV

   Remediation due

   This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

Affected

• cpe dlink/dir-605l firmware2.01mt
• vendor D-Link DIR-605 Routerversion unspecified

Sources

• CISA KEVCVE-2021-40655

  D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

  cisa.gov
• CVE.orgCVE-2021-40655

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-40655

  30-day exploitation probability 86.7%

  first.org
• NIST NVDCVE-2021-40655

  An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

  nvd.nist.gov

References

• Exploit · github.com
• CISA note · legacy.us.dlink.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · dlink.com