CVE-2021-20133

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of those files. Such sensitive information as hashed credentials, hardcoded plaintext passwords for other services, configuration files, and private keys can be disclosed in this fashion. Improper handling of filenames that identify virtual resources, such as "/dev/urandom" allows an attacker to effect a denial of service attack against the command line interfaces of the Quagga services (zebra and ripd).

• CWE-22

• https://www.tenable.com/security/research/tra-2021-44Exploit, Third Party Advisory
• https://www.tenable.com/security/research/tra-2021-44Exploit, Third Party Advisory

Published

Dec 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20128The Profile Name field in the floor plan (Network Menu) page…5.4
• CVE-2021-20129An information disclosure vulnerability exists in Draytek Vi…7.5
• CVE-2021-2013Vulnerability in the Oracle BI Publisher product of Oracle F…7.6
• CVE-2021-20130ManageEngine ADManager Plus Build 7111 contains a post-authe…8.8
• CVE-2021-20131ManageEngine ADManager Plus Build 7111 contains a post-authe…8.8
• CVE-2021-20132Quagga Services on D-Link DIR-2640 less than or equal to ver…8.8
• CVE-2021-20134Quagga Services on D-Link DIR-2640 less than or equal to ver…8.4
• CVE-2021-20135Nessus versions 8.15.2 and earlier were found to contain a l…6.7
• CVE-2021-20136ManageEngine Log360 Builds < 5235 are affected by an imprope…9.8
• CVE-2021-20137A reflected cross-site scripting vulnerability exists in the…6.1
• CVE-2021-20138An unauthenticated command injection vulnerability exists in…8.8
• CVE-2021-20139An unauthenticated command injection vulnerability exists in…8.8