CVE-2021-39615

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-23 · updated 2026-06-17
Weakness: CWE-798

Description

D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

Dlink Dsr-500N Firmware: 1.02

References

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235
https://www.dlink.com/en/security-bulletin/
https://www.nussko.com/advisories/advisory-2021-08-02.txt
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235
https://www.dlink.com/en/security-bulletin/
https://www.nussko.com/advisories/advisory-2021-08-02.txt

Get alerted when CVE-2021-39615 or the next vulnerability affects your stack