Deviceways

Router

D-Link DIR-3040

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
A1
Get OpenWrt firmware Release listed · 25.12.6
rev A1
Open hardware record
Original project github.com

Recorded configuration: 128NAND MB flash; 256 MB RAM

First installation
GUI OEM
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

D-Link DIR-3040 rev A1 — TechInfoDepot (github.com)

Hardware revision
rev A1

Device details

Device details — Source documentation (openwrt.org)

Hardware revision
A1

OpenWrt · A1

OpenWrt · A1 — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM
Availability recorded by source
Available 2024

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 10.0 (v3.0)

D-Link DIR-3040

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03

CVE-2021-21913

Affected firmware
DIR-3040: 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT
Fix
Fix details in the linked record
Read talos CVE record
Details and sources
CVE updated

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to command execution. An attacker can connect to the MQTT service to trigger this vulnerability.

CVE published

CVSS 10.0 (v3.0)

D-Link DIR-3040

A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03

CVE-2021-21820

Affected firmware
DIR-3040: 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of req
Fix
Fix details in the linked record
Read talos CVE record
Details and sources
CVE updated

A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE published

CVSS 9.8 (v3.1)

D-Link DIR-3040

D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.

CVE-2022-44832

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.

CVE published

CVSS 9.1 (v3.0)

D-Link DIR-3040

A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03

CVE-2021-21819

Affected firmware
DIR-3040: 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a se
Fix
Fix details in the linked record
Read talos CVE record
Details and sources
CVE updated

A code execution vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CVE published

CVSS 8.8 (v3.0)

DIR-3040

D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41229

Affected firmware
120B03
Fix
Fix details in the linked record
Read zdi CVE record
Details and sources
Public disclosure CVE updated

D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21671.

ZDI-23-1337 — DIR-3040 (zerodayinitiative.com) ↗vendor-provided URL — DIR-3040 (supportannouncement.us.dlink.com) ↗
Check more security advisories for this device · CVE.org