CVE-2021-39615
9.8 CRITICALD-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succ...
Published: 2021-08-23 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-798
Affected products
| Vendor | Product |
|---|---|
| dlink | dsr-500n_firmware |
Description
D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the cleartext password of the identified hash value, he will be able to log in via SSH or Telnet and thus gain access to the underlying embedded Linux operating system on the device. Fixed in version 2.12/2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-39615
- [Vendor advisory]https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235
- [Vendor advisory]https://www.dlink.com/en/security-bulletin/
- [Exploit reference]https://www.nussko.com/advisories/advisory-2021-08-02.txt
- [Vendor advisory]https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10235
- [Vendor advisory]https://www.dlink.com/en/security-bulletin/
- [Exploit reference]https://www.nussko.com/advisories/advisory-2021-08-02.txt
Related CVEs
Same vendor
- CVE-2026-12174 — A security vulnerability has been detected in D-Link DCS-935L 1.10.01 (8.8 HIGH)
- CVE-2026-11555 — A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006 (3.7 LOW)
- CVE-2026-11497 — A vulnerability has been found in D-Link DCS-5615 1.01.00 (5.3 MEDIUM)
- CVE-2026-11492 — A security flaw has been discovered in D-Link DIR-823G 1.0.2B05 (4.3 MEDIUM)
- CVE-2026-11339 — A vulnerability was detected in D-Link DWR-M920 up to 1.1.50 (6.3 MEDIUM)
Same CWE
- CVE-2026-22312 — The device has a webserver that exposes a REST API authenticated with a constant token (8.6 HIGH)
- CVE-2026-50083 — The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-... (9.1 CRITICAL)
- CVE-2026-10557 — The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices (9.8 CRITICAL)
- CVE-2026-11849 — The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remo... (9.8 CRITICAL)
- CVE-2026-47281 — Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network (9.6 CRITICAL)