Security Digest · Jan 21, 2014 · Vulnerability · Network edge
D-Link DIR-600 CVE-2014-100005: EOL Router CSRF in KEV
A 2014 CSRF in end-of-life D-Link DIR-600 routers (fixed in Rev. Bx firmware 2.17b02) joined CISA KEV in May 2024. Find and retire any that remain.
Our verdict
Check exposure
This is a decade-old bug in a consumer router D-Link no longer supports; the job is to find any DIR-600 still on your networks or your staff's home links and replace it, not to patch.
Who must act: Anyone with a D-Link DIR-600 still in service, including small branch offices, labs and remote workers' home networks that carry company traffic.
Who can relax: Organizations with no DIR-600 units anywhere in their estate; the flaw is specific to this model and does not affect other D-Link products.
- Affected
- D-Link DIR-600 Rev. Bx with firmware 2.16WW and lower
All DIR-600 hardware revisions are end-of-life per CISA's KEV entry - Fixed in
- DIR-600 Rev. Bx firmware 2.17b02 (2014), but the product is unsupported; replacement is the only durable fix
- CVSS
- 8.0 (v3.1, CISA-ADP)
- EPSS
- 43.5% (percentile 99)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- Inventory routers in branch offices, labs and remote-worker setups and flag any D-Link DIR-600, checking the hardware revision on the label under the device.
- Replace every DIR-600 with a currently supported router; do not spend effort re-flashing 2014 firmware onto a device D-Link no longer supports.
- Until a unit is replaced, keep Remote Management disabled, change the admin password, and log out of the web interface after each use.
- Block or alert on any admin interface reachable from the internet on your public addresses.
How to check if you are affected or compromised
- Log in to any surviving DIR-600 and look for administrator accounts you did not create.
- Check whether Remote Management has been switched on, and whether DNS or other WAN settings have changed.
- Scan your public IP ranges for HTTP admin interfaces on ports 80, 443 and 8080 that answer from a router.
What happened#
In January 2014, researcher Dawid Czagan disclosed several cross-site request forgery (CSRF) flaws in the web interface of the D-Link DIR-600, a small consumer router. The CVE record lists what a forged request can do while an administrator is logged in. It can create a new administrator account or turn on remote management through hedwig.cgi. It can apply settings with a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi. It can also make the router ping an attacker-chosen host through diagnostic.php, which reveals the router's WAN address. D-Link published advisory SAP10018 on March 7, 2014. It names firmware 2.17b02 as the fix for hardware revision Bx.
Ten years later, on May 16, 2024, CISA added the CVE to its Known Exploited Vulnerabilities catalog "based on evidence of active exploitation." It was listed alongside a DIR-605 information disclosure bug (CVE-2021-40655) and a Chrome V8 flaw. Federal agencies had a June 6, 2024 deadline. CISA's enrichment scores the bug CVSS 3.1 8.0 with an adjacent-network vector. Its SSVC notes record exploitation as "active" and automatable as "no."
Who is affected#
Per D-Link's advisory, DIR-600 hardware revision Bx on firmware 2.16WW and lower. The KEV entry goes further. It says all associated hardware revisions have reached end-of-life and "should be retired and replaced." D-Link's US legacy products page lists the DIR-600 with a last day of support of December 1, 2010. It says D-Link "recommends retiring these products and replacing them with products that receive firmware updates."
Do you really need to act?#
Only if you still have one. CISA did not publish the evidence behind the listing, and nobody else has explained it either. SecurityWeek noted that "no exploitation reports have been published prior to CISA's warning." The Hacker News wrote that there were "no details on how these shortcomings are exploited." Our searches found no later public report that ties this CVE to a specific campaign as of October 21, 2026.
The attack also has a real precondition. An administrator must be logged in to the router and then load an attacker's page in the same browser. That limits it to targeted or opportunistic attacks on people who manage their own router. Enterprises rarely run DIR-600s. The realistic exposure is a forgotten unit in a small office, a lab, or a remote worker's home, where a hijacked router can redirect DNS or open remote administration. So the verdict is check exposure. Find these devices and retire them. Do not treat them as patchable.
What to do now#
- Inventory routers in branch offices, labs and home-office kits. The hardware revision is printed on the label under the device, next to the serial number, as D-Link's advisory notes.
- Replace any DIR-600 with a supported router. Re-flashing 2014 firmware onto an unsupported device is not a durable fix.
- Until a unit is replaced, keep Remote Management off, which D-Link says is the default. Change the admin password, and log out of the web interface after each use.
- Scan your public addresses for exposed admin interfaces, for example
nmap -Pn -p 80,443,8080 <public-range>, and close anything that answers from a router.
How to tell if you were hit#
On any surviving unit, look for administrator accounts you did not create and check whether Remote Management has been switched on. Compare DNS servers and WAN settings against what you expect. Changed DNS is the usual sign of a hijacked consumer router. If anything is off, factory-reset the device, then replace it.
Timeline#
- — Public disclosure date recorded in the CVE record (Dawid Czagan, InfoSec Institute).
- — D-Link publishes SAP10018 and names firmware 2.17b02 as the fix for Rev. Bx.
- — CVE-2014-100005 is published.
- — CISA adds the CVE to KEV with a retire-and-replace action.
- — Federal remediation deadline.
Vulnerability records
- CVE-2014-100005 · KEV 2024-05-16 · Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev.
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- D-Link — SAP10018: DIR-600 Rev. Bx web configuration pages have CSRF vulnerabilities (F/W 2.16WW and lower) supportannouncement.us.dlink.com
- D-Link — Legacy products: DIR-600 legacy.us.dlink.com
- CVE record — CVE-2014-100005 cve.org
- NVD — CVE-2014-100005 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2014-100005 cisa.gov
- CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 16, 2024) cisa.gov