D-Link Dir-2640-Us Firmware vulnerabilities

7 CVEs affecting D-Link Dir-2640-Us Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-20134, published 2021-12-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20134, published 2021-12-30. High severity, CVSS 8.4. EPSS: 7.5% chance of exploitation in the next 30 days. Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file…
CVE-2021-20132, published 2021-12-30. High severity, CVSS 8.8. EPSS: 4.3% chance of exploitation in the next 30 days. Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those…
CVE-2021-34202, published 2021-06-16. High severity, CVSS 7.8. EPSS: 3.6% chance of exploitation in the next 30 days. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary…
CVE-2021-20133, published 2021-12-30. Medium severity, CVSS 6.1. EPSS: 2.1% chance of exploitation in the next 30 days. Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of…
CVE-2021-34203, published 2021-06-16. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this…
CVE-2021-34204, published 2021-06-16. Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days. D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management.…
CVE-2021-34201, published 2021-06-16. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the…