High · published September 24, 2021
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
🚨 Watch out! An attacker can easily steal usernames and passwords from D-LINK DIR-605 B2 routers with just a forged POST request! 🔥 Think of it like someone sneaking a fake ID to get into a secured area — they bypass security and access confidential information without anyone being the wiser. This vulnerability could allow malicious actors to gain access to sensitive accounts and even take control of your network! With usernames and passwords in hand, attackers could launch further exploits, potentially compromising all connected devices. It’s a serious breach of privacy and security.
Think of it like someone sneaking a fake ID to get into a secured area — they bypass security and access confidential information without anyone being the wiser. CVE-2021-40655 is an information disclosure vulnerability where a forged POST request to the '/getcfg.php' page lets an attacker retrieve sensitive user credentials stored in the device's firmware without any authentication.
This vulnerability could allow malicious actors to gain access to sensitive accounts and even take control of your network! With usernames and passwords in hand, attackers could launch further exploits, potentially compromising all connected devices. It’s a serious breach of privacy and security. Update the D-LINK DIR-605 B2 firmware to version 2.01MT or above immediately to close this security hole. Additionally, consider changing default credentials and regularly auditing your router's security settings to strengthen your defenses. You've got this! With these updates, you'll be one step closer to securing your network. 🛡️