CVE-2021-20132

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
n/aQuagga Services on D-Link DIR-2640 Routers<= 1.11B02

References

Timeline

Published
Dec 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201336.1Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allowCVE-2021-201348.4Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allowCVE-2021-201356.7Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, locaCVE-2021-201369.8ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unaCVE-2021-201376.1A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower routeCVE-2021-201388.8An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/lucCVE-2021-201398.8An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon TowerCVE-2021-20144.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7CVE-2021-201408.8An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon ToweCVE-2021-201418.8An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon ToweCVE-2021-201428.8An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon ToweCVE-2021-201438.8An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Towe