CVE-2021-42627: Critical severity Dlink Dir-615 Firmware vulnerability
The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
D-Link DIR-615 firmwareto a version that resolves this vulnerability.Fixed in 20.06 - Compensating control
Restrict network access to the WAN configuration page (wan.htm) on D-Link DIR-615 so it cannot be reached directly without authentication (e.g., block/limit access to that endpoint to trusted IPs at the network layer).
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42627?
CVE-2021-42627 has been classified as a critical vulnerability due to the direct access it allows to the WAN configuration page without authentication.
How do I fix CVE-2021-42627?
To mitigate CVE-2021-42627, update the firmware of the D-Link DIR-615 to the latest version provided by D-Link.
What devices are affected by CVE-2021-42627?
CVE-2021-42627 specifically affects D-Link DIR-615 devices running firmware version 20.06.
What type of information can be exposed due to CVE-2021-42627?
CVE-2021-42627 can disclose sensitive WAN settings that could be exploited by an attacker.
Can an attacker modify settings through CVE-2021-42627?
Yes, an attacker can potentially modify the data fields of the WAN configuration page due to the lack of authentication in CVE-2021-42627.