Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-20132
• https://www.tenable.com/security/research/tra-2021-44