Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router
Summary: Cisco Talos's Dave McDaniel discovered an information disclosure vulnerability, TALOS-2021-1361 (CVE-2021-21913), in the D-LINK DIR-3040 AC3000 mesh router that an attacker could trigger with a specially crafted network request. The attacker could view sensitive information in the MQTT service, including the primary device's root password, then push payloads to execute remote code, potentially rebooting any device on the mesh or removing devices from it entirely.
Bottom line: The root password of the primary mesh device sits exposed in the MQTT service, so a single crafted request can hand an adversary control over every device joined to that home network. D-LINK has an update available for version 1.13B03, and Talos confirmed that version is exploitable.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21913
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026