CVE-2026-2055

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2055", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-06T06:21:32.971Z", "datePublished": "2026-02-06T13:02:08.052Z", "dateUpdated": "2026-02-23T09:25:21.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:25:21.974Z"}, "title": "D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "D-Link", "product": "DIR-605L", "versions": [{"version": "2.06B01", "status": "affected"}, {"version": "2.13B01", "status": "affected"}], "modules": ["DHCP Client Information Handler"]}, {"vendor": "D-Link", "product": "DIR-619L", "versions": [{"version": "2.06B01", "status": "affected"}, {"version": "2.13B01", "status": "affected"}], "modules": ["DHCP Client Information Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Information Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR"}}], "timeline": [{"time": "2026-02-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-06T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-18T01:03:36.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "pjqwudi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.344615", "name": "VDB-344615 | D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344615", "name": "VDB-344615 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.744225", "name": "Submit #744225 | D-Link DIR619L\u3001DIR605L 2.06B01\u30012.13B01 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md", "tags": ["related"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md#poc--result", "tags": ["exploit"]}, {"url": "https://www.dlink.com/", "tags": ["product"]}], "tags": ["unsupported-when-assigned"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T16:46:22.437746Z", "id": "CVE-2026-2055", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:46:35.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2055", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T16:46:22.437746Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T16:46:27.295Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "pjqwudi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR"}}], "affected": [{"vendor": "D-Link", "modules": ["DHCP Client Information Handler"], "product": "DIR-605L", "versions": [{"status": "affected", "version": "2.06B01"}, {"status": "affected", "version": "2.13B01"}]}, {"vendor": "D-Link", "modules": ["DHCP Client Information Handler"], "product": "DIR-619L", "versions": [{"status": "affected", "version": "2.06B01"}, {"status": "affected", "version": "2.13B01"}]}], "timeline": [{"lang": "en", "time": "2026-02-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-06T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-18T01:03:36.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.344615", "name": "VDB-344615 | D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344615", "name": "VDB-344615 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.744225", "name": "Submit #744225 | D-Link DIR619L\u3001DIR605L 2.06B01\u30012.13B01 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md", "tags": ["related"]}, {"url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md#poc--result", "tags": ["exploit"]}, {"url": "https://www.dlink.com/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Information Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:25:21.974Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2055", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:25:21.974Z", "dateReserved": "2026-02-06T06:21:32.971Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-06T13:02:08.052Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["DHCP Client Information Handler"], "product": "DIR-605L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "2.06B01"}, {"status": "affected", "version": "2.13B01"}]}, {"modules": ["DHCP Client Information Handler"], "product": "DIR-619L", "vendor": "D-Link", "versions": [{"status": "affected", "version": "2.06B01"}, {"status": "affected", "version": "2.13B01"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-605l_firmware:2.06b01:*:*:*:*:*:*:*", "matchCriteriaId": "2F1CE88F-3DB4-451D-82FE-866FD48FD056", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-605l:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD4E3AA2-EC1C-4219-8E13-B52D30A7FA06", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dlink:dir-619l_firmware:2.13b01:*:*:*:*:*:*:*", "matchCriteriaId": "61AF2288-99EC-45EE-8390-1A8FA01BDEDD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dlink:dir-619l:-:*:*:*:*:*:*:*", "matchCriteriaId": "F99992A1-E442-4D83-84F4-44F44C25219C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Information Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "Se ha identificado una debilidad en D-Link DIR-605L y DIR-619L 2.06B01/2.13B01. El elemento afectado es una funci\u00f3n desconocida del componente DHCP Client Information Handler. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a la revelaci\u00f3n de informaci\u00f3n. El ataque puede lanzarse de forma remota. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. Esta vulnerabilidad solo afecta a productos que ya no tienen soporte por parte del mantenedor."}], "id": "CVE-2026-2055", "lastModified": "2026-06-17T10:30:12.360", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2055", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T16:46:22.437746Z", "version": "2.0.3"}}]}, "published": "2026-02-06T13:15:54.777", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md#poc--result"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.344615"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.344615"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.744225"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://www.dlink.com/"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:43:20.861369+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011issued firmware update that addresses the DHCP Client Information disclosure for DIR\u2011605L and DIR\u2011619L routers.", "If a patch is not yet available, disable the DHCP client feature or restrict inbound DHCP traffic using the router\u2019s firewall or an external network firewall to prevent unauthorized requests.", "Continuously monitor the device and network logs for suspicious DHCP activity and isolate the router from critical segments until a patch or workaround is applied."], "summary": {"action": "Patch Update", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected products are D\u2011Link DIR\u2011605L and DIR\u2011619L routers. Only the specific firmware versions 2.06B01 for the DIR\u2011605L and 2.13B01 for the DIR\u2011619L are impacted, and the devices are no longer supported by the manufacturer. Users running these models should check the exact firmware revision against those listed to confirm exposure.", "description_and_impact": "D-Link DIR\u2011605L and DIR\u2011619L routers running firmware versions 2.06B01 and 2.13B01 are vulnerable to an information disclosure when a crafted request is sent to the DHCP Client Information Handler. The weakness allows an attacker to obtain sensitive information from the device, potentially revealing configuration data or other internal details. The exposed data could be used to facilitate further attacks, such as password extraction or network mapping. This vulnerability is classified under CWE\u2011200 and CWE\u2011284, indicating confidentiality and access control weaknesses.", "risk_and_exploitability": "The CVSS score of 6.9 reflects a moderate severity. The EPSS score is below 1\u202f%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so it is not known to have been actively exploited. However, the ability for remote exploitation and the public availability of a proof\u2011of\u2011concept suggests that cautious action is warranted."}}}}, "created": "2026-02-09T10:52:21.861537+00:00", "updated": "2026-04-17T22:45:29.941735+00:00", "vendors": ["d-link", "d-link$PRODUCT$dir-605l", "d-link$PRODUCT$dir-619l"]}