D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.
References
| Link | Resource |
|---|---|
| http://d-link.com | Broken Link |
| http://dir-2640-us.com | Broken Link URL Repurposed |
| https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204 | Exploit Third Party Advisory |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
| http://d-link.com | Broken Link |
| http://dir-2640-us.com | Broken Link URL Repurposed |
| https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204 | Exploit Third Party Advisory |
| https://www.dlink.com/en/security-bulletin/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 06:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://d-link.com - Broken Link | |
| References | () http://dir-2640-us.com - Broken Link, URL Repurposed | |
| References | () https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204 - Exploit, Third Party Advisory | |
| References | () https://www.dlink.com/en/security-bulletin/ - Vendor Advisory |
14 Feb 2024, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://dir-2640-us.com - Broken Link, URL Repurposed |
Information
Published : 2021-06-16 20:15
Updated : 2024-11-21 06:10
NVD link : CVE-2021-34204
Mitre link : CVE-2021-34204
CVE.ORG link : CVE-2021-34204
JSON object : View
Products Affected
dlink
- dir-2640-us
- dir-2640-us_firmware
CWE
CWE-522
Insufficiently Protected Credentials