CVE-2021-40655: D-Link DIR-605 Router Information Disclosure Vulnerability

CVE-2021-40655 is an information disclosure vulnerability in D-Link DIR-605 routers. Attackers can forge a POST request to the /getcfg.php page and retrieve a username and password. Because these credentials can grant administrative access to the device, successful abuse can expose network configuration, connected clients, and any traffic that passes through the router.

This matters for IT and security teams that still operate legacy consumer or small-office routers. The product line has reached end-of-life and end-of-service status, so no further vendor patches are expected. Unpatched devices left on production networks remain a persistent risk of credential theft and subsequent device takeover.

How it works

The underlying weakness is classified as CWE-863 (Incorrect Authorization). The router’s web management interface fails to enforce proper authorization checks on the /getcfg.php endpoint. An unauthenticated or insufficiently authenticated attacker can craft a POST request that causes the device to return sensitive configuration data, including a username and password.

In practice, an attacker who can reach the management interface—whether from the local LAN or, if remote management is enabled, from the internet—sends a specially formed request to that page. The device responds with the requested credentials. No further exploit code details are required for defenders to understand the risk; the core issue is unauthorized access to configuration data that should be protected. Exact request parameters and response formats must be confirmed against the vendor advisory or public technical analyses of the CVE.

Am I affected? How to find it in your systems

D-Link DIR-605 routers are typically found in home, small-office, or branch environments as consumer-grade wireless gateways. They may still appear in inventories of older deployments, secondary networks, or unmanaged guest Wi-Fi segments.

• Inventory all network devices by model string “DIR-605” (or close variants) using asset-management tools, network scanners that fingerprint HTTP banners, or SNMP/sysObjectID queries.
• Check the device’s web interface or sticker for the exact hardware revision and firmware version; compare those values against the vendor advisory for this CVE.
• Look for any exposure of the management interface on ports commonly used by the product (usually TCP 80 or 443) from both internal and external address spaces.
• Review web-server access logs or firewall logs for unexpected POST requests targeting /getcfg.php. Unusual source IPs, high request rates, or successful responses containing credential-like strings are indicators of possible exploitation.
• Because the product is end-of-life, any remaining DIR-605 unit should be treated as potentially vulnerable until proven otherwise by the vendor’s official guidance.

How to remediate

The CISA-required action for this vulnerability is retirement and replacement. All associated hardware revisions have reached end-of-life or end-of-service; no security updates are forthcoming. Follow the vendor’s instructions to decommission the DIR-605 and migrate to a currently supported router model that receives ongoing firmware maintenance.

• Plan a cut-over window, back up any needed configuration data (excluding credentials), and replace the device with a supported alternative.
• After replacement, change any passwords that may have been stored on or reused with the old router, and verify that the new device’s management interface is not exposed to untrusted networks.
• Document the retirement in your asset inventory so the obsolete model does not reappear later.

If a temporary firmware update or configuration change is mentioned in the original vendor advisory, apply it only after confirming the exact steps; otherwise treat replacement as the sole durable fix.

If you can't patch immediately

While arranging replacement, reduce exposure with compensating controls appropriate to an unauthenticated information-disclosure flaw on a network appliance.

• Segment the router so that its management interface is reachable only from a tightly controlled administrative VLAN or jump host; block all other sources at the firewall.
• Disable remote (WAN-side) management entirely if it is enabled.
• Place a web application firewall or reverse-proxy rule in front of any remaining management path to drop or challenge POST requests to /getcfg.php and similar configuration endpoints.
• Increase monitoring: alert on any access to the management IP, especially POST activity, and retain logs long enough for forensic review.
• If the device is no longer required for production traffic, power it off or isolate it completely until it can be removed.

These steps do not eliminate the vulnerability but shrink the attack surface until the hardware can be retired.

If your data may have been exposed

Actively exploited router vulnerabilities frequently lead to credential theft and subsequent network compromise. If logs or other evidence suggest that /getcfg.php was accessed by an unauthorized party, assume the recovered username and password may have been used to reconfigure the device or pivot further. Rotate any credentials that were stored on or reused with the router, examine connected systems for signs of lateral movement, and consider a free exposure scan of organizational email addresses against known breach data sets to determine whether related accounts have already appeared in public dumps.