CVE-2021-34204

6.8 mediumEPSS 1.1%

Medium (6.8) in dlink dir-2640-us firmware. EPSS 1.1% chance of exploitation in the next 30 days.

D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2021-06-16
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

dlink:dir-2640-us_firmware

References

https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204
https://www.dlink.com/en/security-bulletin/
https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204
https://www.dlink.com/en/security-bulletin/

Check your stack JSON