CVE-2021-20132: High severity d-link dir-2640-us firmware vulnerability
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20132?
CVE-2021-20132 has a high severity rating due to the use of default hard-coded credentials allowing remote administrative access.
How do I fix CVE-2021-20132?
To fix CVE-2021-20132, update the D-Link DIR-2640 firmware to a version later than 1.11B02 that removes the hard-coded credentials.
What devices are affected by CVE-2021-20132?
CVE-2021-20132 affects the D-Link DIR-2640 router running firmware versions less than or equal to 1.11B02.
Can CVE-2021-20132 be exploited remotely?
Yes, CVE-2021-20132 can be exploited remotely due to the presence of hard-coded credentials enabling unauthorized access.
What could an attacker do if they exploit CVE-2021-20132?
If an attacker exploits CVE-2021-20132, they can gain full administrative control over the router's zebra or ripd services, operating with root privileges.