CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

Path traversal

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service zebra or ripd. Subsequen...

Path traversal

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of tho...

Hardcoded credentials

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

CVE-2021-20134

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service zebra or ripd. Subsequen...

CVE-2021-20134

The CVE-2021-20134 entry concerns Quagga services on the D-Link DIR-2640 (firmware version

CVE-2021-20132

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

CVE-2021-20133

The CVE-2021-20133 entry concerns the D-Link DIR-2640 router (Quagga Services) with versions up to 1.11B02, vulnerable to an absolute path traversal. The issue allows a remote, authenticated attacker to set the MOTD banner to an arbitrary file, enabling disclosure of sensitive data such as hashed...

CVE-2021-20133

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of tho...

CVE-2021-20132

CVE-2021-20132 affects D-Link DIR-2640 with Quagga services (zebra and ripd) running on versions up to 1.11B02. The root cause is default hard-coded credentials, allowing a remote attacker to gain administrative access (root privileges, UID 0) to these services. Several connected records (e.g., R...

D-Link DIR-2640 has a path traversal vulnerability

The D-Link DIR-2640 is a high power Wi-Fi router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DIR-2640, which can be exploited by remote attackers to submit a special request that can be used in an application context to read the contents of system files...

CVE-2021-20132: Use of Hard-coded Credentials

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router i.e., as the "admin" user, UID 0...

D-Link DIR-2640 has a path traversal vulnerability

The D-Link DIR-2640 is a high power Wi-Fi router from D-Link, a Taiwan-based company. A path traversal vulnerability exists in the D-Link DIR-2640 Quagga 1.11B02 and earlier versions, which can be exploited for remote code execution due to the lack of effective filtering of path parameters in the...

PT-2021-13791

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions less than or equal to 1.11B02 Description: The issue allows a remote, authenticated attacker to exploit an absolute path traversal vulnerability in Quagga Services. This enables the attacker to set an arbitrary file o...

PT-2021-13789

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions less than or equal to 1.11B02 Description: The issue allows a remote attacker to gain administrative access to the zebra or ripd services, which are running with root privileges on the router. This is due to the use o...

PT-2021-13790

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2640 versions less than or equal to 1.11B02 Description: The issue allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, enabling them to read all or some of the contents of those...

CVE-2021-20134: Improper Limitation of a Pathname to a Restricted Directory

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service zebra or ripd. Subsequen...

CVE-2021-20133: Improper Limitation of a Pathname to a Restricted Directory

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of tho...

PT-2021-27997

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves several functions, including...