Is CVE-2021-40655 (D-Link DIR-605 Router Information Disclosure) being exploited in the wild?

Yes. CISA added CVE-2021-40655 to its Known Exploited Vulnerabilities catalogue on 16 May 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.

What being “exploited in the wild” means for this CVE

For a vulnerability like CVE-2021-40655, “in the wild” means you should treat it as an active exposure problem, not a theoretical one. CISA’s KEV catalogue is the practical signal to prioritize verification and response, because it reflects confirmed exploitation rather than a lab-only finding. For background on the exploitability triage model, see CISA Known Exploited Vulnerabilities Catalog and the CVE Program.

On a device like a router, exploitation often matters because the exposed information can be used to pivot into broader network access, credential abuse, or follow-on reconnaissance. The question is therefore not only whether the flaw exists, but whether any exposed devices are reachable, whether configuration interfaces are internet-facing, and whether the disclosed credentials were reused elsewhere.

For administrators trying to interpret KEV status on consumer and edge equipment, the key issue is that an information disclosure flaw can be enough to move an attacker from guessing to direct access. That changes the response from routine hardening to urgent exposure reduction and account hygiene.

How to verify exposure and reduce attack surface

Start by confirming whether any D-Link DIR-605 units are still deployed, reachable, or remotely manageable. If they are present, treat the management interface and any related configuration endpoints as the first place to verify, because the vulnerable request path is part of the exposure pattern described in the advisory. If a device is no longer supported, decommissioning is often safer than trying to preserve an aging edge appliance.

Then check whether the router’s administrative credentials, shared passwords, or downstream network secrets may have been exposed or reused. If credentials were disclosed or could reasonably have been recovered by an attacker, rotate them and review any dependent systems that trusted that router’s management plane or network position.

Where internet exposure is not required for operations, remove it. Limiting remote administration, restricting management to trusted addresses, and segmenting the device away from sensitive assets reduces the blast radius if the flaw is probed again.

What to do when patching or replacement must wait

If you cannot immediately replace or remediate the router, treat compensating controls as temporary only. Isolate the device, block direct administrative access from untrusted networks, and monitor for unusual requests to the management interface or signs that configuration data has been pulled. If the router sits in front of a sensitive environment, move critical services behind a cleaner control plane as soon as possible.

This is also the point to review whether the exposed credentials could have been used for anything beyond the router itself. In small-office and home-office environments, reused passwords and weak separation between admin accounts, Wi-Fi access, and other services often turn a single disclosure into a wider compromise.

Risk and Threat Considerations

Information disclosure on an edge router is risky because it can collapse the attacker’s effort from discovery to direct misuse of administrative material. Once credentials or configuration details are exposed, the same device can become an entry point for persistence, traffic interception, or further reconnaissance on the internal network.

Failure mechanism: An attacker sends the crafted request to the vulnerable configuration endpoint, retrieves usernames and passwords, and then uses that access to alter settings, intercept traffic, or move into adjacent systems.

Impact: The likely consequences are unauthorized router administration, network visibility for the attacker, and a higher chance of follow-on compromise if the disclosed credentials are reused or if the device is trusted by other systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Exposure of router credentials makes account control and rotation central.
Recommendation — Review and rotate any credentials exposed by the router and remove stale accounts.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	The flaw can expose usernames and passwords that must be managed as authenticators.
	AC-17 — Remote Access	Mitigating the issue often requires restricting remote management paths.
Recommendation — Rotate exposed authenticators and invalidate any compromised credential material. Restrict remote administrative access to the router and trusted management networks.
ISO/IEC 27001:2022	A.8.20 — Networks Security	Edge router exploitation affects network exposure and segmentation controls.
Recommendation — Harden the router’s network exposure and segment it away from sensitive assets.
OWASP ASVS	V16 — Security Logging and Error Handling	Verification includes watching for suspicious management requests and misuse.
Recommendation — Log and review administrative requests to detect probing or abuse of the device.

Practitioner Guidance

What to verify: Confirm whether any DIR-605 devices are still in service, whether management access is exposed beyond the local network, and whether the affected account material has been reused anywhere else. Those three checks determine whether this is a dormant issue or an active incident-response concern.

Decision rule: If the router can still disclose credentials or if you cannot prove it is isolated and unsupported, prioritize replacement over prolonged mitigation. For edge devices, “temporarily protected” often means “still one misconfiguration away from compromise.”

Practitioner takeaway: The important question is not whether the flaw exists, but whether any live device can still leak credentials that matter. Once that is true, exposure reduction and credential rotation become the immediate priorities, not inventory cleanup.