CVE-2021-40655
D-Link DIR-605 Router Information Disclosure Vulnerability
Published Sep 24, 2021 · updated Jun 16, 2026 · dlink dir-605l firmware
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 24, 2021 · Catalog
Detected
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
May 16, 2024 · CISA KEV
Known exploited
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Jun 6, 2024 · CISA KEV
Remediation due
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Jun 16, 2026 · Catalog
Updated
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
Required action
This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
CISA due date Jun 6, 2024
Affected
- cpe dlink/dir-605l firmware2.01mt
- vendor D-Link DIR-605 Routerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-40655
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
cisa.gov - CVE.orgVulnerability recordCVE-2021-40655
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-40655
30-day exploitation probability 86.7%
first.org - NIST NVDVulnerability recordCVE-2021-40655
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
nvd.nist.gov