Read the docs
TI-2021-03434 Aliases CVE-2021-20134GHSA-v4h7-5mx9-q833

Path traversal in Quagga Services on D-Link DIR-2640 Routers

Priority MEDIUM 47CWE-22Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion.

Why it matters now

EPSS 0.07774 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Quagga Services on D-Link DIR-2640 Routersup to 1.11B02—No fix listedCNA
  • Quagga Services on D-Link DIR-2640 Routers Vendor— Affected up to 1.11B02 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dir-2640-us_firmware:*:*:*:*:*:*:*:*up to 1.11b02VulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-2640-us:-:*:*:*:*:*:*:*not specified by NVDRunning onD-Link Japan K.K.
  • cpe:2.3:o:dlink:dir-2640-us_firmware:*:*:*:*:*:*:*:* Versions up to 1.11b02 Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-2640-us:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20134
  2. 2026-10-03 Alias added: GHSA-v4h7-5mx9-q833

References

Exploit 1

  • TI-2021-03432 Hard-coded credentials in Quagga Services on D-Link DIR-2640 Routers CVSS 3.1HIGH 8.8
  • TI-2021-13308 There are multiple out-of-bounds vulnerabilities in some processes of D-Link… CVSS 3.1HIGH 7.8
  • TI-2021-13309 D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. CVSS 3.1HIGH 8.1
  • TI-2021-13310 D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. CVSS 3.1MEDIUM 6.8
  • TI-2021-13307 D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. CVSS 3.1HIGH 7.1
  • TI-2021-03433 Path traversal in Quagga Services on D-Link DIR-2640 Routers CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences