CVE-2021-40655: D-Link DIR-605 router credential disclosure via getcfg.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows unauthenticated remote credential theft, is listed in CISA KEV, and has a very high EPSS score, with no patch available because the product line is end-of-life.

What it is

D-Link DIR-605 B2 firmware 2.01MT exposes credentials through the /getcfg.php page, which fails to enforce proper authorization. A crafted POST request returns the device username and password, giving attackers administrative access to the router. The flaw is remotely reachable without authentication, making it a serious exposure for internet-facing devices.

Impact

An attacker obtains the router's administrative username and password, enabling full control of the device and any traffic or configuration it manages. This can lead to further network compromise, traffic interception, or use of the router as a pivot point.

Attack surface

Reachable over the network via HTTP through the /getcfg.php endpoint; the CVSS vector shows no privileges and no user interaction required. Any host that can reach the router's web interface can attempt the forged POST request.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-05-16, and EPSS gives a 30-day probability of 0.86659 (99.73rd percentile). A public exploit reference exists on GitHub, and no ransomware campaign use is documented.

What to do

• Retire and replace affected D-Link DIR-605 B2 devices, which are end-of-life and end-of-service per CISA's required action.
• If the device cannot be replaced immediately, remove its web interface from internet exposure and restrict management access to a trusted internal network.
• Change default and any exposed administrative credentials, and monitor for unauthorized configuration changes.
• Apply any vendor security bulletin guidance for D-Link legacy products, though no fixed firmware is identified in this record.

Detection

• Monitor router and perimeter logs for POST requests to /getcfg.php, especially from unexpected external sources.
• Alert on outbound or inbound traffic to known D-Link DIR-605 management interfaces from untrusted networks.
• Watch for authentication attempts or configuration changes on the router following suspicious getcfg.php access.
• Use network scanning to identify internet-exposed D-Link DIR-605 devices and prioritize their removal.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.