CVE-2021-40655

What is the D-Link DIR-605L?

The D-Link DIR-605L is a consumer-grade Wi-Fi router that reached end-of-life (EOL) and end-of-service (EOS). Like many SOHO routers, the DIR-605L provides web-based administration through a built-in HTTP server. SOHO routers are consistently targeted by botnets and threat actors because they are internet-connected, often run for years without updates, and provide strategic network access when compromised. Credential disclosure vulnerabilities in routers allow attackers to take over the device, enabling traffic interception, DNS hijacking, botnet enrollment, and use as a network pivot point.

Overview

CVE-2021-40655 is an information disclosure vulnerability (CWE-863: Incorrect Authorization) in D-Link DIR-605L routers. An unauthenticated attacker can send a specially crafted POST request to the /getcfg.php endpoint on the router's web administration interface, and the server responds with the router's administrator username and password in cleartext. No authentication or prior access is required. With the admin credentials obtained, the attacker has full control over the router — including DNS settings, port forwarding, wireless configuration, and the ability to install modified firmware.

D-Link has not released a patch because the DIR-605L has reached end-of-life. CISA's required action is to retire and replace the device. CISA added this to KEV in May 2024, confirming active exploitation against unretired DIR-605L devices.

Affected Versions

Technical Details

• Root cause: Incorrect authorization (CWE-863) — the /getcfg.php endpoint on the router's embedded web server responds to POST requests without requiring authentication, and returns configuration data including plaintext admin credentials
• Exploitation: An attacker sends a crafted POST request to http://<router-ip>/getcfg.php with specific parameters; the router responds with the admin username and password in cleartext — no session cookie, no credentials required to trigger the disclosure
• Full device takeover: With admin credentials, the attacker can: change DNS servers (enabling phishing/interception), configure port forwarding for C2 access, modify Wi-Fi passwords, install modified firmware, and use the device as a network pivot for attacking internal hosts
• Confidentiality-only CVSS: C:H/I:N/A:N — the vulnerability itself only discloses credentials; the follow-on impact of full device control is not captured in the CVSS base score
• No authentication required: AV:N/PR:N — exploitable from the internet if the router's management interface is internet-accessible (common for many consumer router deployments)
• No patch: D-Link will not issue a fix for EOL hardware — the only remediation is replacement

Discovery

Reported and published by security researchers. The three-year gap between CVE publication (2021) and CISA KEV addition (May 2024) reflects continued active exploitation of unretired DIR-605L devices in botnet campaigns and targeted network intrusions.

Exploitation Context

End-of-life SOHO routers with known credential disclosure vulnerabilities are persistent targets for Mirai-variant botnets, cryptomining infrastructure operators, and threat actors building proxy networks. The DIR-605L credential disclosure provides an easy path to router takeover for any attacker who can reach the management interface. Organizations and individuals who have not retired DIR-605L devices (often installed years ago and forgotten) remain vulnerable with no patch available. The CISA KEV addition with an EOL-specific required action — "retire and replace" — reflects that the only real remediation is device replacement.

Remediation

1. Retire and replace the D-Link DIR-605L immediately — this device is EOL with no patch available. Replace with a current-generation router that receives security updates
2. As an interim measure if immediate replacement is not possible: disable remote management / web admin access from WAN (internet) side — restrict management to LAN only
3. Change the default admin password to a strong unique credential — this does not fix the vulnerability but raises the bar for exploitation
4. Place the router behind an ISP modem/gateway with NAT to prevent direct internet access to the management interface
5. Contact your ISP if you need assistance selecting a replacement router that meets your connectivity requirements