Vulnerability Intelligence Report
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
CVE-2014-100005
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
8.0
HIGH
Exploitability:2.1
Impact Score:5.9
EPSS Probability:42.41%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-352 ↗CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| dlink | dir-600_firmware | all |
| dlink | dir-600 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2015-01-13T00:00:00 |
| Published | 2015-01-13T11:00:00 |
| Patch Date | 2014-01-21 |
| Last Updated | 2025-10-22T00:05:34 |
Community Chatter & Buzz