erroneo.us
Search all guides⌘K

Security Digest · Sep 24, 2021 · Vulnerability · Network edge

D-Link DIR-605 CVE-2021-40655: EOL Router Leaks Admin Login

An unauthenticated POST to getcfg.php returns the admin password on end-of-life D-Link DIR-605 routers. No fix exists; find and replace any left.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

There is no patch and never will be; any DIR-605 or DIR-605L still in service, especially one with its admin page reachable from the internet, should be replaced, and its admin password treated as known.

Who must act: Anyone with a D-Link DIR-605 or DIR-605L still routing traffic, including branch offices, labs and remote workers' home networks that carry company traffic.

Who can relax: Organizations with no DIR-605-family routers anywhere in their estate; nothing in this CVE affects supported D-Link models.

Affected
D-Link DIR-605 / DIR-605L hardware revision B2, firmware 2.01MT (as tested by the reporter)
All DIR-605 hardware revisions, which CISA's KEV entry says are end-of-life
Fixed in
None. The DIR-605 reached its last day of support on Feb 1, 2015, and the DIR-605L reached end of service on May 2, 2019; replacement is the only fix
CVSS
7.5 (v3.1, NVD)
EPSS
86.7% (percentile 99.7)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory routers in branch offices, labs and home-office kits and flag any D-Link DIR-605 or DIR-605L.
  2. Replace every unit with a currently supported router; there is no firmware fix to install.
  3. Until a unit is replaced, make sure its web admin page is not reachable from the WAN side.
  4. Assume the router's admin password is known: change it, and change any other account that reused it.
  5. Scan your public IP ranges for router admin pages that answer on ports 80, 443 or 8080.

How to check if you are affected or compromised

  • Test only routers you own: an unauthenticated POST to /getcfg.php that returns DEVICE.ACCOUNT data with a password field means the unit is vulnerable.
  • Search proxy, firewall or IDS logs for POST requests to /getcfg.php, especially with SERVICES=DEVICE.ACCOUNT in the body.
  • On any surviving unit, check for changed DNS servers, remote management switched on, or admin settings you did not make.

What happened#

CVE-2021-40655 was published on September 24, 2021. The CVE record describes an information disclosure bug in the D-Link DIR-605, hardware revision B2, firmware 2.01MT. An attacker who sends a forged POST request to /getcfg.php gets back a user name and password. No login is needed.

The reporter's proof of concept, archived three days later, shows how little it takes. One request with the body SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a returns the admin credentials in plain text. The same repository included a script to check lists of addresses in bulk. NVD scores the bug CVSS 3.1 7.5, network-reachable with no privileges.

On May 16, 2024, CISA added the CVE to the KEV catalog on the same day as a DIR-600 CSRF bug (CVE-2014-100005). The required action is not to patch. CISA says all hardware revisions are end-of-life and "should be retired and replaced."

Who is affected#

The naming is muddled. The CVE record and KEV entry say DIR-605. The reporter's README is titled DIR-605L, and NVD's product data points to DIR-605L B2 firmware 2.01MT. Treat both models as in scope. D-Link's legacy page for the DIR-605 lists a last day of support of February 1, 2015. Its end-of-service notice for the DIR-605L says support, including security fixes, ended on May 2, 2019. No fixed firmware exists.

The same getcfg.php request also works on other old D-Link firmware. CVE-2020-9376 describes it on the DIR-610. D-Link's SAP10182 says that model is past end of support and will not be fixed. A scanner that sends this request is not limited to one model.

Do you really need to act?#

Only if you still have one, but then the risk is real. Unlike the DIR-600 CSRF, this bug needs no logged-in victim. Anyone who can reach the admin page gets the password. That page is normally on the LAN side, so the worst case is a unit with remote management on, or an attacker already on the network.

Why the bug was added to KEV in 2024 has not been explained. CISA cited "evidence of active exploitation" but published none. SecurityWeek noted the proof of concept had been public since 2021. The Hacker News said there were "no details" on how the bug is exploited. We found no later report tying it to a campaign as of October 23, 2026. Enterprise exposure is small, which is why the verdict is check exposure: find and replace.

What to do now#

  1. Inventory routers in small offices, labs and home-office kits. The model and hardware revision are on the label under the device.
  2. Replace any DIR-605 or DIR-605L with a supported router.
  3. Until then, turn off remote management and confirm the admin page does not answer from the WAN side.
  4. Change the admin password, and any other account that reused it.
  5. Scan your public ranges, for example nmap -Pn -p 80,443,8080 <public-range>, and close any router admin page you find.

How to tell if you were hit#

On a router you own, this request shows whether it is vulnerable: curl -s -d 'SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a' http://192.168.0.1/getcfg.php. If the reply contains a <password> field, it is. Search proxy, firewall and IDS logs for POSTs to /getcfg.php. Then check the router for changed DNS servers, remote management switched on, or settings you did not make. If anything is off, factory-reset the unit and replace it.

Timeline#

  • — Last day of support for the DIR-605, per D-Link.
  • — The DIR-605L reaches end of service.
  • — CVE-2021-40655 is published.
  • — The proof-of-concept repository is first archived.
  • — CISA adds the CVE to KEV with a retire-and-replace action.
  • — Federal remediation deadline.

Vulnerability records

  • CVE-2021-40655 · KEV 2024-05-16 · An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CVE record — CVE-2021-40655 cve.org
  2. NVD — CVE-2021-40655 nvd.nist.gov
  3. D-Link — Legacy products: DIR-605 legacy.us.dlink.com
  4. D-Link — DIR-605L End of Service Life Announcement legacyfiles.us.dlink.com
  5. CISA — Known Exploited Vulnerabilities: CVE-2021-40655 cisa.gov
  6. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 16, 2024) cisa.gov
  7. Reporter's proof of concept (archived Sep 27, 2021) — D-LINK-DIR-605 web.archive.org
  8. D-Link — SAP10182: (non-US) DIR-610 multiple vulnerabilities on end-of-service product supportannouncement.us.dlink.com
  9. CVE record — CVE-2020-9376 cve.org

Coverage and analysis

  1. SecurityWeek — CISA Warns of Exploited Vulnerabilities in EOL D-Link Products securityweek.com
  2. The Hacker News — CISA Warns of Actively Exploited D-Link Router Vulnerabilities thehackernews.com