D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.
References
| Link | Resource |
|---|---|
| http://d-link.com | Broken Link |
| http://dir-2640-us.com | Broken Link URL Repurposed |
| https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204 | Exploit Third Party Advisory |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
14 Feb 2024, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://dir-2640-us.com - Broken Link, URL Repurposed |
28 Jun 2021, 14:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:dlink:dir-2640-us:-:*:*:*:*:*:*:* |
23 Jun 2021, 22:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:dlink:dir-2640-us_firmware:1.01b04:*:*:*:*:*:*:* cpe:2.3:h:d-link:dir-2640-us:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204 - Exploit, Third Party Advisory | |
| References | (MISC) https://www.dlink.com/en/security-bulletin/ - Vendor Advisory | |
| References | (MISC) http://dir-2640-us.com - Broken Link | |
| References | (MISC) http://d-link.com - Broken Link | |
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 6.8 |
| CWE | CWE-522 |
16 Jun 2021, 21:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-16 20:15
Updated : 2024-02-14 01:17
NVD link : CVE-2021-34204
Mitre link : CVE-2021-34204
CVE.ORG link : CVE-2021-34204
JSON object : View
Products Affected
dlink
- dir-2640-us_firmware
- dir-2640-us
CWE
CWE-522
Insufficiently Protected Credentials