Deviceways

Router

D-Link DIR-2640

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
A1
Get OpenWrt firmware Release listed · 25.12.6
rev A1
Open hardware record
A1
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 128NAND MB flash; 256 MB RAM

First installation
D-Link Recovery GUI
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

d-link dir-2640 a1 — device documentation (github.com)Device details — Source documentation (openwrt.org)

Hardware revision
A1

Device details

D-Link DIR-2640 rev A1 — TechInfoDepot (github.com)

Hardware revision
rev A1

OpenWrt · A1

OpenWrt · A1 — Source documentation (openwrt.org)

Installation routes recorded
D-Link Recovery GUI
Recovery routes recorded
D-Link Recovery GUI
Availability recorded by source
Available 2024

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 8.8 (v3.0)

DIR-2640

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability

CVE-2024-5293

Affected firmware
1.11B02_BETA02
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21853.

ZDI-24-444 — DIR-2640 (zerodayinitiative.com) ↗
CVE published

CVSS 8.8 (v3.0)

DIR-2640

D-Link DIR-2640 prog.cgi Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32149

Affected firmware
1.11B02 (non-US, CA version)
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-2640 prog.cgi Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web management interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19546.

ZDI-23-541 — DIR-2640 (zerodayinitiative.com) ↗vendor-provided URL — DIR-2640 (supportannouncement.us.dlink.com) ↗
CVE published

CVSS 6.8 (v3.0)

DIR-2640

D-Link DIR-2640 EmailFrom Command Injection Remote Code Execution Vulnerability

CVE-2023-32153

Affected firmware
1.11B02 (non-US, CA version)
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-2640 EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the EmailFrom parameter provided to the HNAP1 endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19550.

ZDI-23-545 — DIR-2640 (zerodayinitiative.com) ↗vendor-provided URL — DIR-2640 (supportannouncement.us.dlink.com) ↗
CVE published

CVSS 6.8 (v3.0)

DIR-2640

D-Link DIR-2640 DestNetwork Command Injection Remote Code Execution Vulnerability

CVE-2023-32151

Affected firmware
1.11B02 (non-US, CA version)
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-2640 DestNetwork Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the DestNetwork parameter provided to the HNAP1 endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19548.

ZDI-23-543 — DIR-2640 (zerodayinitiative.com) ↗vendor-provided URL — DIR-2640 (supportannouncement.us.dlink.com) ↗
CVE published

CVSS 6.8 (v3.0)

DIR-2640

D-Link DIR-2640 PrefixLen Command Injection Remote Code Execution Vulnerability

CVE-2023-32150

Affected firmware
1.11B02 (non-US, CA version)
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-2640 PrefixLen Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the PrefixLen parameter provided to the HNAP1 endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19547.

ZDI-23-542 — DIR-2640 (zerodayinitiative.com) ↗vendor-provided URL — DIR-2640 (supportannouncement.us.dlink.com) ↗
Check more security advisories for this device · CVE.org