# CVE-2014-100005: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

> CVE-2014-100005: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability. CVSS 8.0 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2014-100005
Last updated: 2025-10-22T00:05:34Z

- Published: 2015-01-13 11:00 UTC · Updated: 2025-10-22 00:05 UTC · Assigner: mitre
- CVSS: 8.0 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 43.5%, 99th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2024-05-16, federal due date 2024-06-06, ransomware use: Unknown

## Description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

## CISA required action

This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.

## Affected vendors and products

- dlink: dir-600
- dlink: dir-600\_firmware

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2014-100005)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2014-100005)
- [http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/](http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/)
- [http://secunia.com/advisories/57304](http://secunia.com/advisories/57304)
- [http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018](http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/91794](https://exchange.xforce.ibmcloud.com/vulnerabilities/91794)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2014-100005 · Markdown: https://rewindex.com/cve/CVE-2014-100005.md · JSON: https://rewindex.com/api/v1/cves/CVE-2014-100005 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T01:58:50.732Z