CVE-2021-39614
9.8 CRITICALD-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file
Published: 2021-08-23 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-798
Affected products
| Vendor | Product |
|---|---|
| dlink | dvx-2000ms_firmware |
Description
D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext passwords can be recovered from the hash values.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-39614
- [Vendor advisory]https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10236
- [Vendor advisory]https://www.dlink.com/en/security-bulletin/
- [Exploit reference]https://www.nussko.com/advisories/advisory-2021-08-01.txt
- [Vendor advisory]https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10236
- [Vendor advisory]https://www.dlink.com/en/security-bulletin/
- [Exploit reference]https://www.nussko.com/advisories/advisory-2021-08-01.txt
Related CVEs
Same vendor
- CVE-2026-12174 — A security vulnerability has been detected in D-Link DCS-935L 1.10.01 (8.8 HIGH)
- CVE-2026-11555 — A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006 (3.7 LOW)
- CVE-2026-11497 — A vulnerability has been found in D-Link DCS-5615 1.01.00 (5.3 MEDIUM)
- CVE-2026-11492 — A security flaw has been discovered in D-Link DIR-823G 1.0.2B05 (4.3 MEDIUM)
- CVE-2026-11339 — A vulnerability was detected in D-Link DWR-M920 up to 1.1.50 (6.3 MEDIUM)
Same CWE
- CVE-2026-22312 — The device has a webserver that exposes a REST API authenticated with a constant token (8.6 HIGH)
- CVE-2026-50083 — The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-... (9.1 CRITICAL)
- CVE-2026-10557 — The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices (9.8 CRITICAL)
- CVE-2026-11849 — The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remo... (9.8 CRITICAL)
- CVE-2026-47281 — Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network (9.6 CRITICAL)