CSRF in Dlink Dir-600
CVE-2014-100005
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.424 (98.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dlink Dir-600
- Dlink Dir-600_firmware
- N/a — versions n/a
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)
Frequently asked questions
- What is CVE-2014-100005?
- CVE-2014-100005 is a high-severity vulnerability in Dlink Dir-600, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.0/10. Published 2015-01-13.
- How severe is CVE-2014-100005?
- High severity. CVSS v3 base score is 8.0 out of 10.
- Is CVE-2014-100005 known to be exploited?
- Yes. CVE-2014-100005 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-05-16), indicating it is being actively exploited. 2 public proof-of-concept repositories are indexed.