CVE-2014-100005: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
Vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
dlink: dir-600dlink: dir-600_firmware
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/ (opens in new tab)
- secunia.com/advisories/57304 (opens in new tab)
- securityadvisories.dlink.com/security/publication.aspx (opens in new tab)
- exchange.xforce.ibmcloud.com/vulnerabilities/91794 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)