Information Disclosure in D‑Link DIR‑605 Router (CVE‑2021‑40655) Exposes Credentials
What It Is – The DIR‑605 home/SMB router contains an information‑disclosure flaw that lets an unauthenticated attacker retrieve the device’s admin username and password by sending a crafted POST request to /getcfg.php.
Exploitability – The vulnerability is publicly disclosed (CVE‑2021‑40655) and can be exploited with a simple HTTP request; no authentication or prior access is required. Public PoC scripts are already circulating.
Affected Products – D‑Link DIR‑605 wireless router (all firmware versions prior to the vendor’s security update).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Credential leakage bypasses the fundamental control of “only authorized users may access the device,” a core control objective that maps to many frameworks (e.g., NIST CSF Identify / Protect).
- Continuous evidence of due diligence – Demonstrating that all network‑edge devices are patched and that credential changes are logged provides audit‑ready evidence of a robust control environment.
- Supply‑chain assurance – The router is a third‑party component; maintaining a documented oversight process for firmware updates is essential for a defensible security posture.
Recommended Actions
- Apply D‑Link’s latest firmware that mitigates CVE‑2021‑40655.
- Immediately change default admin credentials and enforce strong password policies.
- Enable logging of authentication events on the router and integrate logs into your SIEM for continuous monitoring.
- Document the remediation steps in your asset‑management system to provide evidence for audits.
Source: CISA KEV – CVE‑2021‑40655