CVE-2021-20132
Last modified
CVE-2021-20132 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).. EPSS estimates a 4.29% chance of exploitation in the next 30 days.
Description
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-2640-Us Firmware | <= 1.11b02 |
References
- https://www.tenable.com/security/research/tra-2021-44Exploit, Third Party Advisory
- https://www.tenable.com/security/research/tra-2021-44Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-20132?
How severe is CVE-2021-20132?
How do I fix CVE-2021-20132?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-20127An arbitrary file deletion vulnerability exists in the file …8.1
- CVE-2021-20128The Profile Name field in the floor plan (Network Menu) page…5.4
- CVE-2021-20129An information disclosure vulnerability exists in Draytek Vi…7.5
- CVE-2021-2013Vulnerability in the Oracle BI Publisher product of Oracle F…7.6
- CVE-2021-20130ManageEngine ADManager Plus Build 7111 contains a post-authe…8.8
- CVE-2021-20131ManageEngine ADManager Plus Build 7111 contains a post-authe…8.8
- CVE-2021-20133Quagga Services on D-Link DIR-2640 less than or equal to ver…6.1
- CVE-2021-20134Quagga Services on D-Link DIR-2640 less than or equal to ver…8.4
- CVE-2021-20135Nessus versions 8.15.2 and earlier were found to contain a l…6.7
- CVE-2021-20136ManageEngine Log360 Builds < 5235 are affected by an imprope…9.8
- CVE-2021-20137A reflected cross-site scripting vulnerability exists in the…6.1
- CVE-2021-20138An unauthenticated command injection vulnerability exists in…8.8
Are you affected by CVE-2021-20132?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST