D-Link DIR-600 CVE-2014-100005: EOL Router CSRF in KEV
This is a decade-old bug in a consumer router D-Link no longer supports; the job is to find any DIR-600 still on your networks or your staff's home links and replace it, not to patch.
Must act: Anyone with a D-Link DIR-600 still in service, including small branch offices, labs and remote workers' home networks that carry company traffic.
Can relax: Organizations with no DIR-600 units anywhere in their estate; the flaw is specific to this model and does not affect other D-Link products.
- Inventory routers in branch offices, labs and remote-worker setups and flag any D-Link DIR-600, checking the hardware revision on the label under the device.
- Replace every DIR-600 with a currently supported router; do not spend effort re-flashing 2014 firmware onto a device D-Link no longer supports.
- Until a unit is replaced, keep Remote Management disabled, change the admin password, and log out of the web interface after each use.