---
title: "D-Link DIR-605 CVE-2021-40655: EOL Router Leaks Admin Login"
url: https://erroneo.us/security/briefs/d-link-dir-605-cve-2021-40655-getcfg-credential-leak/
description: "An unauthenticated POST to getcfg.php returns the admin password on end-of-life D-Link DIR-605 routers. No fix exists; find and replace any left."
type: security-brief
section: "Security Digest"
date_published: 2021-09-24
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-40655"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# D-Link DIR-605 CVE-2021-40655: EOL Router Leaks Admin Login

**Verdict: Check exposure.** There is no patch and never will be; any DIR-605 or DIR-605L still in service, especially one with its admin page reachable from the internet, should be replaced, and its admin password treated as known.

- **Who must act:** Anyone with a D-Link DIR-605 or DIR-605L still routing traffic, including branch offices, labs and remote workers' home networks that carry company traffic.
- **Who can relax:** Organizations with no DIR-605-family routers anywhere in their estate; nothing in this CVE affects supported D-Link models.
- **Affected:** D-Link DIR-605 / DIR-605L hardware revision B2, firmware 2.01MT (as tested by the reporter); All DIR-605 hardware revisions, which CISA's KEV entry says are end-of-life
- **Fixed:** None. The DIR-605 reached its last day of support on Feb 1, 2015, and the DIR-605L reached end of service on May 2, 2019; replacement is the only fix
- **CVEs:** CVE-2021-40655
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory routers in branch offices, labs and home-office kits and flag any D-Link DIR-605 or DIR-605L.
2. Replace every unit with a currently supported router; there is no firmware fix to install.
3. Until a unit is replaced, make sure its web admin page is not reachable from the WAN side.
4. Assume the router's admin password is known: change it, and change any other account that reused it.
5. Scan your public IP ranges for router admin pages that answer on ports 80, 443 or 8080.

### How to check if you are affected

- Test only routers you own: an unauthenticated POST to /getcfg.php that returns DEVICE.ACCOUNT data with a password field means the unit is vulnerable.
- Search proxy, firewall or IDS logs for POST requests to /getcfg.php, especially with SERVICES=DEVICE.ACCOUNT in the body.
- On any surviving unit, check for changed DNS servers, remote management switched on, or admin settings you did not make.

## What happened

CVE-2021-40655 was published on September 24, 2021. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-40655) describes an information disclosure bug in the D-Link DIR-605, hardware revision B2, firmware 2.01MT. An attacker who sends a forged POST request to `/getcfg.php` gets back a user name and password. No login is needed.

The reporter's [proof of concept](https://web.archive.org/web/20210927183305/https://github.com/Ilovewomen/D-LINK-DIR-605/), archived three days later, shows how little it takes. One request with the body `SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a` returns the admin credentials in plain text. The same repository included a script to check lists of addresses in bulk. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-40655) scores the bug CVSS 3.1 7.5, network-reachable with no privileges.

On May 16, 2024, CISA [added](https://www.cisa.gov/news-events/alerts/2024/05/16/cisa-adds-three-known-exploited-vulnerabilities-catalog) the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655) on the same day as a DIR-600 CSRF bug (CVE-2014-100005). The required action is not to patch. CISA says all hardware revisions are end-of-life and "should be retired and replaced."

## Who is affected

The naming is muddled. The CVE record and KEV entry say DIR-605. The reporter's README is titled DIR-605L, and NVD's product data points to DIR-605L B2 firmware 2.01MT. Treat both models as in scope. D-Link's [legacy page for the DIR-605](https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5) lists a last day of support of February 1, 2015. Its [end-of-service notice for the DIR-605L](https://legacyfiles.us.dlink.com/dir-605l/REVB/DIR-605L_END_OF_SERVICE_ANNOUNCEMENT.pdf) says support, including security fixes, ended on May 2, 2019. No fixed firmware exists.

The same `getcfg.php` request also works on other old D-Link firmware. [CVE-2020-9376](https://www.cve.org/CVERecord?id=CVE-2020-9376) describes it on the DIR-610. D-Link's [SAP10182](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182) says that model is past end of support and will not be fixed. A scanner that sends this request is not limited to one model.

## Do you really need to act?

Only if you still have one, but then the risk is real. Unlike the DIR-600 CSRF, this bug needs no logged-in victim. Anyone who can reach the admin page gets the password. That page is normally on the LAN side, so the worst case is a unit with remote management on, or an attacker already on the network.

Why the bug was added to KEV in 2024 has not been explained. CISA cited "evidence of active exploitation" but published none. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-in-eol-d-link-products/) noted the proof of concept had been public since 2021. [The Hacker News](https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-d-link.html) said there were "no details" on how the bug is exploited. We found no later report tying it to a campaign as of October 23, 2026. Enterprise exposure is small, which is why the verdict is check exposure: find and replace.

## What to do now

1. Inventory routers in small offices, labs and home-office kits. The model and hardware revision are on the label under the device.
2. Replace any DIR-605 or DIR-605L with a supported router.
3. Until then, turn off remote management and confirm the admin page does not answer from the WAN side.
4. Change the admin password, and any other account that reused it.
5. Scan your public ranges, for example `nmap -Pn -p 80,443,8080 <public-range>`, and close any router admin page you find.

## How to tell if you were hit

On a router you own, this request shows whether it is vulnerable: `curl -s -d 'SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a' http://192.168.0.1/getcfg.php`. If the reply contains a `<password>` field, it is. Search proxy, firewall and IDS logs for POSTs to `/getcfg.php`. Then check the router for changed DNS servers, remote management switched on, or settings you did not make. If anything is off, factory-reset the unit and replace it.

## Timeline

- Feb 1, 2015 — Last day of support for the DIR-605, per D-Link.
- May 2, 2019 — The DIR-605L reaches end of service.
- Sep 24, 2021 — CVE-2021-40655 is published.
- Sep 27, 2021 — The proof-of-concept repository is first archived.
- May 16, 2024 — CISA adds the CVE to KEV with a retire-and-replace action.
- Jun 6, 2024 — Federal remediation deadline.

## Sources

1. [CVE record — CVE-2021-40655](https://www.cve.org/CVERecord?id=CVE-2021-40655)
2. [NVD — CVE-2021-40655](https://nvd.nist.gov/vuln/detail/CVE-2021-40655)
3. [D-Link — Legacy products: DIR-605](https://legacy.us.dlink.com/pages/product.aspx?id=2b09e95d90ff4cb38830ecc04c89cee5)
4. [D-Link — DIR-605L End of Service Life Announcement](https://legacyfiles.us.dlink.com/dir-605l/REVB/DIR-605L_END_OF_SERVICE_ANNOUNCEMENT.pdf)
5. [CISA — Known Exploited Vulnerabilities: CVE-2021-40655](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655)
6. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 16, 2024)](https://www.cisa.gov/news-events/alerts/2024/05/16/cisa-adds-three-known-exploited-vulnerabilities-catalog)
7. [Reporter's proof of concept (archived Sep 27, 2021) — D-LINK-DIR-605](https://web.archive.org/web/20210927183305/https://github.com/Ilovewomen/D-LINK-DIR-605/)
8. [D-Link — SAP10182: (non-US) DIR-610 multiple vulnerabilities on end-of-service product](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182)
9. [CVE record — CVE-2020-9376](https://www.cve.org/CVERecord?id=CVE-2020-9376)
10. [SecurityWeek — CISA Warns of Exploited Vulnerabilities in EOL D-Link Products](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-in-eol-d-link-products/)
11. [The Hacker News — CISA Warns of Actively Exploited D-Link Router Vulnerabilities](https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-d-link.html)

---
Source page: https://erroneo.us/security/briefs/d-link-dir-605-cve-2021-40655-getcfg-credential-leak/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt