CVE-2021-40655 is an information disclosure vulnerability in D-Link DIR-605 Router. CISA added it to the Known Exploited Vulnerabilities catalogue on 16 May 2024, which means attackers have used it in real attacks. D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
What the vulnerability means in a router
CVE-2021-40655 is not just a generic web flaw, it is an information disclosure issue in an internet-facing router interface. Because the attacker can forge a POST request to /getcfg.php, the weakness sits in a path that is meant to return device configuration data and ends up exposing login material instead.
That matters because routers are boundary devices: when they leak credentials, the compromise can extend beyond the device itself into internal network access, administrative takeover, and follow-on movement. For context on how CVE records are structured and tracked, see the CVE Program and the NIST National Vulnerability Database.
Why information disclosure in a router is dangerous
Information disclosure vulnerabilities often look less severe than code execution at first glance, but exposed usernames and passwords can be enough to turn a single web request into full administrative compromise. On a router, those credentials may protect configuration access, network segmentation settings, remote management, DNS controls, or other functions that shape the entire local environment.
Once an attacker can read secrets from the management interface, they may no longer need to bypass authentication at all. That makes the issue especially sensitive when the router is exposed to the internet or reachable from an untrusted internal network segment, because the attack path becomes simple, repeatable, and low noise.
How organisations should assess exposure
Exposure checks start with asset inventory, because teams cannot remediate a router they do not know they still have. The next step is to determine whether the device is reachable from untrusted networks, whether remote administration is enabled, and whether vendor advisory language matches the exact model in use.
For router and appliance flaws, version details and fixed-build guidance should come from the vendor advisory and the CISA KEV catalogue rather than from recollection or third-party summaries. If the device is still in service, compare it against current supported firmware and confirm whether it is in a network zone where an external request to the management interface is possible.
Remediation and verification after exposure
If a patch or firmware update is available, apply it through the vendor-recommended path and verify that management credentials are no longer retrievable through the vulnerable request path. If the device cannot be updated immediately, restrict access to the management interface, remove internet exposure, and place the router behind stronger administrative controls until replacement or remediation is complete.
After remediation, review the device for signs that the weakness was already used. That includes checking administrative logs where available, looking for unexpected configuration changes, and treating exposed usernames and passwords as compromised material that may need rotation across dependent systems.
Risk and Threat Considerations
This vulnerability is dangerous because it gives an attacker a low-complexity way to steal administrative credentials from a network edge device. If the router is reachable remotely, the weakness can be exploited without authenticating first, which makes it useful for opportunistic scanning, mass exploitation, and rapid follow-on compromise.
Failure mechanism: A forged request to the vulnerable configuration endpoint returns sensitive account data instead of enforcing access control, allowing the attacker to harvest credentials and reuse them against the router or adjacent services.
Impact: Successful exploitation can lead to administrative takeover, configuration tampering, internal network exposure, and the need to rotate any credentials, sessions, or related secrets that may have been disclosed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers exposed router credentials and their lifecycle after disclosure |
| AC-17 — Remote Access | Applies to remote management paths that can expose router admin interfaces | |
| SI-2 — Flaw Remediation | Supports timely remediation of an exploited router vulnerability | |
| Recommendation — Rotate compromised credentials and enforce shorter authenticator lifetimes. Restrict remote administrative access to trusted networks and approved channels. Track the flaw, apply vendor remediation, and verify the fix on affected devices. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Addresses secure administration and lifecycle control for network devices |
| CIS-6 — Access Control Management | Supports limiting management access to router interfaces and exposed credentials | |
| Recommendation — Inventory routers, harden their management surfaces, and remove unnecessary exposure. Limit administrative access paths and revoke credentials that may have been exposed. | ||
| NIST CSF 2.0 | PR.AA-05 — Asset Authorization | Relates to controlling and validating access to administrative interfaces and assets |
| DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Supports monitoring for exploitation attempts against exposed router services | |
| Recommendation — Authorize only trusted administrative access to network devices. Monitor router management services for suspicious requests and access attempts. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network security | Applies to protecting the security of network devices and their management surfaces |
| A.8.8 — Management of technical vulnerabilities | Fits the need to identify, prioritise and remediate the router flaw | |
| Recommendation — Harden router management interfaces and segment access to them. Track vulnerable routers and remediate or replace them promptly. | ||
Practitioner Guidance
Why practitioners should care: Treat router credential disclosure as an identity and access incident, not only a device bug. The immediate technical defect is in the router, but the operational consequence is often broader because the leaked password may unlock management functions or be reused elsewhere.
Practitioner takeaway: Prioritise remediation for edge devices that expose management interfaces to untrusted networks, and assume any disclosed credentials must be handled as compromised until proven otherwise.