CVE-2021-40655

What it actually does

The flaw is an unauthenticated information disclosure/authorization bypass in D-Link DIR-605 B2 firmware 2.01MT where a network-accessible attacker can forge a POST request to /getcfg.php and retrieve configuration data that includes usernames and passwords. The CVSS vector indicates remote exploitation over the network, low complexity, no privileges required, and no user interaction, with primary impact to confidentiality. Because the issue exposes credentials, compromise can extend beyond read-only disclosure if the recovered credentials are reused for router administration, upstream services, VPNs, Wi-Fi, or other management interfaces. The provided package metadata also lists gpac on Debian 11 with a fixed version of 1.0.1+dfsg1-4+deb11u2; organizations should validate whether this mapping applies to their asset inventory, because the vulnerability description specifically refers to D-Link DIR-605 firmware.

Why it matters to the business

An attacker who can reach the vulnerable management interface may be able to steal device credentials and use them to take over network equipment, change routing or DNS settings, intercept traffic, establish persistence, or pivot into internal networks. This vulnerability is in CISA KEV with known exploitation in the wild and a remediation due date of 2024-06-06, which has passed, so exposed systems should be treated as high-priority legacy risk. The high EPSS score indicates a strong likelihood of exploitation activity, especially against internet-facing or remotely managed devices. Operational consequences can include loss of network control, outages from unauthorized configuration changes, credential compromise, and increased incident-response workload for perimeter infrastructure.

How an attack unfolds

An attacker first identifies an exposed D-Link DIR-605 B2 management interface running the vulnerable firmware. They then send a crafted HTTP POST request directly to /getcfg.php without authenticating, abusing the endpoint’s failure to properly enforce authorization before returning configuration data. If the request is accepted, the device returns sensitive configuration values, potentially including administrative usernames and passwords. The attacker can then use the recovered credentials to log in to the router or other services where the credentials are reused, modify settings such as DNS, port forwarding, firewall rules, or remote administration, and maintain access through configuration changes. Public reporting and KEV inclusion indicate active exploitation in the wild, so historical evidence should be reviewed even if the device is later patched or replaced.

How to fix it

Upgrade affected D-Link DIR-605 B2 firmware where a vendor-supported fixed firmware is available; if no supported fixed firmware exists for the hardware revision, replace the device with a supported model. Disable internet-facing access to the management interface and restrict administration to trusted management networks or VPN-only access. Rotate all credentials stored on or used by affected devices, including router admin passwords, Wi-Fi pre-shared keys, ISP credentials, VPN secrets, and any reused service accounts. Review and reset configuration items that an attacker may have modified, including DNS servers, port forwards, firewall rules, remote-management settings, dynamic DNS, and administrative users. If the supplied Debian package mapping applies to the environment, update gpac on Debian 11 to 1.0.1+dfsg1-4+deb11u2 or later. Because this is a KEV-listed vulnerability with a passed due date, prioritize remediation of any exposed assets immediately.

How to confirm the fix worked

Confirm whether any D-Link DIR-605 B2 devices are present and verify their firmware version through the management UI, configuration export, asset inventory, or authenticated device query. Validate that /getcfg.php is not reachable from untrusted networks, especially the public internet. After remediation, attempt a controlled unauthenticated request to /getcfg.php from an untrusted network segment and confirm that sensitive configuration is not returned. Verify that remote management is disabled or access-controlled, administrative passwords have been changed, and no unexpected users, DNS servers, port forwards, firewall rules, or remote-access settings remain. For Debian systems where the supplied package mapping is relevant, confirm that gpac is installed at version 1.0.1+dfsg1-4+deb11u2 or later using package-management records.

Typical attack path

1. Scan public IP ranges or internal networks for D-Link DIR-605 management interfaces.
2. Fingerprint the device model and firmware version through HTTP headers, page content, or management UI artifacts.
3. Send a forged unauthenticated POST request to /getcfg.php requesting configuration data.
4. Extract usernames, passwords, and other sensitive configuration values from the HTTP response.
5. Use the disclosed credentials to authenticate to the router management interface or other reused services.
6. Change router settings, enable remote access, alter DNS/routing/firewall rules, or pivot further into the network.
7. Remove obvious signs of access or rely on normal-looking administrative configuration changes to remain undetected.

How to detect it

Review router web-access logs, reverse-proxy logs, firewall logs, IDS/IPS alerts, VPN logs, and any centralized syslog from network devices for HTTP POST requests to /getcfg.php, especially from unauthenticated sessions, external IP addresses, scanning infrastructure, or unusual geographies. Look for request bodies that ask for device account or configuration services and responses containing account, password, or configuration XML-like data. Examine router configuration history and backups for unexpected changes after suspicious requests, including altered DNS resolvers, enabled remote management, new administrator accounts, changed passwords, new port forwards, modified firewall rules, dynamic DNS settings, or VPN configuration changes. Correlate suspicious HTTP requests with subsequent successful logins to the router management interface from the same source IP or shortly afterward. Because this vulnerability is known exploited in the wild, absence of current exposure does not rule out prior compromise; retain and review historical logs as far back as available.

• POST /getcfg.php
• /getcfg.php
• SERVICES=DEVICE.ACCOUNT
• DEVICE.ACCOUNT
• AUTHORIZED_GROUP
• <name>Admin</name>
• <password>
• HTTP request to /getcfg.php from external source
• Unauthenticated POST request to /getcfg.php
• D-Link DIR-605

What your security team should do

• Immediately inventory for D-Link DIR-605 B2 devices and any exposed management interfaces; prioritize internet-facing devices first.
• Patch, replace, or isolate vulnerable devices; do not rely on perimeter obscurity if /getcfg.php remains reachable.
• Rotate all credentials that may have been stored on the device or reused elsewhere, treating disclosed passwords as compromised.
• Review router configurations for unauthorized DNS, port-forwarding, firewall, remote-management, VPN, and administrator-account changes.
• Block access to router administrative interfaces from the internet and enforce management access through trusted networks or VPN.
• Search historical web, proxy, firewall, IDS, and device logs for unauthenticated POST requests to /getcfg.php and configuration-disclosure patterns.
• Add SIEM detections for suspicious requests to /getcfg.php, especially POST requests from external sources or requests containing configuration service names.
• If gpac on Debian 11 is relevant in the asset inventory, update to 1.0.1+dfsg1-4+deb11u2 or later and verify package state across managed hosts.