High severity · published Jan 13, 2015
CVE-2014-100005
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
In wildKEV
8.0
CVSS
43.5%
EPSS
Yes
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)43.5% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed May 16, 2024
Federal remediation dueJun 6, 2024
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-600 Firmware · Dlink
through 2.16ww · source: NVD, CISA
DI
Dir-600 · Dlink
0 · source: CISA
DR
DIR-600 Router · D-Link
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-100005
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-100005
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
third-party-advisory
http://secunia.com/advisories/57304
vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91794
x_refsource_MISC
http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/
x_refsource_CONFIRM
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018
More from Dir-600 Firmware
9.8
CVE-2025-15194
D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow
9.8
CVE-2018-25115
D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
9.8
CVE-2013-10069
D-Link Devices Unauthenticated RCE
9.8
CVE-2013-10048
D-Link Devices command.php Unauthenticated RCE
9.8
CVE-2024-7357
D-Link DIR-600 soap.cgi soapcgi_main os command injection