CVE-2021-39613
📋 TL;DR
This vulnerability involves hard-coded credentials with weak passwords in D-Link DVG-3104MS devices, allowing attackers to gain unauthorized access. It affects specific firmware versions of this VoIP gateway product. Since these products are no longer supported, users cannot receive official patches.
💻 Affected Systems
- D-Link DVG-3104MS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing remote attackers to gain administrative access, intercept communications, modify configurations, and use the device as a pivot point into internal networks.
Likely Case
Unauthorized access to device management interface leading to configuration changes, service disruption, and potential credential harvesting from connected systems.
If Mitigated
Limited impact if device is isolated in a secure network segment with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires access to /etc/passwd file and ability to crack weak password hashes. Public advisory includes hash details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10237
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Change all passwords
linuxManually change passwords for all user accounts including undocumented ones
passwd <username>
Remove undocumented accounts
linuxDelete undocumented user accounts from /etc/passwd and /etc/shadow
userdel <username>
🧯 If You Can't Patch
- Isolate device in separate VLAN with strict firewall rules
- Implement network monitoring for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check /etc/passwd file for undocumented user accounts and examine password hashes for weak algorithmsCheck Version:
cat /etc/version or check web interfaceVerify Fix Applied:
Verify undocumented accounts are removed and all passwords use strong hashing algorithms📡 Detection & Monitoring
Log Indicators:
- Failed login attempts for undocumented usernames
- Successful logins from unusual IP addresses
Network Indicators:
- Unauthorized access to management interfaces
- Unusual outbound connections from device
SIEM Query:
source="dlink-dvg" AND (event_type="authentication" AND (username="*undocumented*" OR result="failure"))🔗 References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10237
- https://www.dlink.com/en/security-bulletin/
- https://www.nussko.com/advisories/advisory-2021-08-01.txt
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10237
- https://www.dlink.com/en/security-bulletin/
- https://www.nussko.com/advisories/advisory-2021-08-01.txt
