Cybersecurity specialists reported the detection of at least 5 vulnerabilities in the DIR-3040 routers, developed by the technology firm D-Link. According to the report, successful exploitation of these flaws would allow threat actors to access confidential data and other attack variants.
Below are brief reports of the flaws detected, in addition to their respective identification keys and scores assigned according to the Common Vulnerability Scoring System (CVSS).
It is worth noting that these vulnerabilities have not been addressed by the vendor, making it necessary for users of affected deployments to stay abreast of any new D-Link announcements.
CVE-2021-21816: The excessive data output by the application in the Syslog functionality would allow remote threat actors to gain unauthorized access to sensitive information on the affected system.
The flaw received a CVSS score of 6.3/10.
CVE-2021-21820: The presence of hard-coded credentials in application code in the Libcli Test Environment functionality allows remote threat actors to access the affected system via hard-coded credentials.
The vulnerability received a CVSS score of 9.1/10 and its exploitation could result in the compromise of the affected systems.
CVE-2021-21819: The improper input validation in the Libcli Test Environment functionality allows remote admins to pass specially crafted data on the target application and run arbitrary OS commands.
The vulnerability received a CVSS score of 8.1/10 and its exploitation would allow the compromise of the affected systems.
CVE-2021-21817: The excessive data output by the application in the Zebra IP Routing Manager functionality allows remote attackers to gain unauthorized access to sensitive information on the system.
The vulnerability received a 6.9/10 score and allows a remote attacker to gain access to potentially sensitive information.
CVE-2021-21818: The presence of hard-coded password in the Zebra IP Routing Manager functionality allows remote unauthenticated attackers to send a specially crafted network request and cause a denial of service (DoS) condition.
The flaw received a CVSS score of 7.1/10.
The flaws reside that these vulnerabilities reside in the following versions of D-Link DIR-3040: 1.13 B03.
Cybersecurity experts mention that these flaws can be exploited by remote threat actors and malicious hackers just have to send specially crafted requests to the affected systems to complete a successful attack. The good news is that researchers have found no evidence of exploiting these vulnerabilities in the wild.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.