# CVE-2021-40655: D-Link - Information Disclosure

> Live exploitation tracking for CVE-2021-40655 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-40655

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** D-Link DIR-605
- **Weaknesses:** CWE-863 (Incorrect Authorization)
- **Tags:** firewall, iot

## Description

An informtion disclosure issue exists in D-Link product running the D-Link-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

## CrowdSec analysis

[CVE-2021-40655](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-40655) is a vulnerability affecting certain D-Link products, where information disclosure can occur if a remote attacker forges requests to a specific configuration page.

CrowdSec has been tracking this vulnerability and its exploits since 5th of June 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-40655 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2021-40655 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers typically attempt to exploit this issue by making requests to endpoints ending with `/getcfg.php`.

## Timeline

- 2021-09-24: CVE Published. CVE-2021-40655 is published to NVD.
- 2024-05-16: CISA KEV. CVE-2021-40655 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-06-05: Rule Released. CrowdSec releases a rule to detect CVE-2021-40655 exploitation attempts against the CrowdSec Network.
- 2024-06-06: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-40655 for the first time.

## References

- https://www.dlink.com/en/security-bulletin/
- https://github.com/Ilovewomen/D-LINK-DIR-605/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40655.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-40655) follows observed exploitation activity for CVE-2021-40655. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.