CVE-2021-20133

Vulnerability

An absolute path traversal vulnerability exists in the Quagga services (zebra and ripd) on D-Link DIR-2640 routers running firmware version 1.11B02 or earlier. The message of the day banner configuration option accepts an arbitrary file path without proper validation, allowing an authenticated attacker to read any file on the system. The services listen on TCP ports 2601 and 2602 and run with root privileges. Authentication to the Quagga CLI is required, but a default password is used (see CVE-2021-20132) [1].

Exploitation

An attacker who can reach the Quagga services (typically on the local network) authenticates using the default password, enters configuration terminal mode, and sets the banner motd to the path of a target file (e.g., /etc/passwd). Upon reconnecting to the service, the file contents are displayed as the banner. For denial of service, the attacker sets the banner to a special device file such as /dev/urandom, causing the CLI to become unresponsive due to an infinite stream of random data [1].

Impact

Successful exploitation allows an authenticated attacker to read sensitive files including hashed credentials, hardcoded plaintext passwords, configuration files, and private keys. The attacker can also cause a denial of service against the Quagga CLI interfaces (zebra and ripd), disrupting network configuration management. No file write or remote code execution is achieved through this vulnerability alone [1].

Mitigation

As of the publication date (2021-12-30), no firmware update is available to address this vulnerability. Users should disable the Quagga services if not required, or restrict network access to ports 2601 and 2602 to trusted hosts only. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].