--- title: "D-Link DIR-600 CVE-2014-100005: EOL Router CSRF in KEV" url: https://erroneo.us/security/briefs/d-link-dir-600-cve-2014-100005-csrf-kev/ description: "A 2014 CSRF in end-of-life D-Link DIR-600 routers (fixed in Rev. Bx firmware 2.17b02) joined CISA KEV in May 2024. Find and retire any that remain." type: security-brief section: "Security Digest" date_published: 2014-01-21 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2014-100005"] severity: "high" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # D-Link DIR-600 CVE-2014-100005: EOL Router CSRF in KEV **Verdict: Check exposure.** This is a decade-old bug in a consumer router D-Link no longer supports; the job is to find any DIR-600 still on your networks or your staff's home links and replace it, not to patch. - **Who must act:** Anyone with a D-Link DIR-600 still in service, including small branch offices, labs and remote workers' home networks that carry company traffic. - **Who can relax:** Organizations with no DIR-600 units anywhere in their estate; the flaw is specific to this model and does not affect other D-Link products. - **Affected:** D-Link DIR-600 Rev. Bx with firmware 2.16WW and lower; All DIR-600 hardware revisions are end-of-life per CISA's KEV entry - **Fixed:** DIR-600 Rev. Bx firmware 2.17b02 (2014), but the product is unsupported; replacement is the only durable fix - **CVEs:** CVE-2014-100005 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory routers in branch offices, labs and remote-worker setups and flag any D-Link DIR-600, checking the hardware revision on the label under the device. 2. Replace every DIR-600 with a currently supported router; do not spend effort re-flashing 2014 firmware onto a device D-Link no longer supports. 3. Until a unit is replaced, keep Remote Management disabled, change the admin password, and log out of the web interface after each use. 4. Block or alert on any admin interface reachable from the internet on your public addresses. ### How to check if you are affected - Log in to any surviving DIR-600 and look for administrator accounts you did not create. - Check whether Remote Management has been switched on, and whether DNS or other WAN settings have changed. - Scan your public IP ranges for HTTP admin interfaces on ports 80, 443 and 8080 that answer from a router. ## What happened In January 2014, researcher Dawid Czagan disclosed several cross-site request forgery (CSRF) flaws in the web interface of the D-Link DIR-600, a small consumer router. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2014-100005) lists what a forged request can do while an administrator is logged in. It can create a new administrator account or turn on remote management through `hedwig.cgi`. It can apply settings with a `SETCFG,SAVE,ACTIVATE` action to `pigwidgeon.cgi`. It can also make the router ping an attacker-chosen host through `diagnostic.php`, which reveals the router's WAN address. D-Link published advisory [SAP10018](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10018) on March 7, 2014. It names firmware 2.17b02 as the fix for hardware revision Bx. Ten years later, on May 16, 2024, CISA [added](https://www.cisa.gov/news-events/alerts/2024/05/16/cisa-adds-three-known-exploited-vulnerabilities-catalog) the CVE to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005) "based on evidence of active exploitation." It was listed alongside a DIR-605 information disclosure bug (CVE-2021-40655) and a Chrome V8 flaw. Federal agencies had a June 6, 2024 deadline. CISA's enrichment scores the bug CVSS 3.1 8.0 with an adjacent-network vector. Its SSVC notes record exploitation as "active" and automatable as "no." ## Who is affected Per D-Link's advisory, DIR-600 hardware revision Bx on firmware 2.16WW and lower. The KEV entry goes further. It says all associated hardware revisions have reached end-of-life and "should be retired and replaced." D-Link's US [legacy products page](https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283) lists the DIR-600 with a last day of support of December 1, 2010. It says D-Link "recommends retiring these products and replacing them with products that receive firmware updates." ## Do you really need to act? Only if you still have one. CISA did not publish the evidence behind the listing, and nobody else has explained it either. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-in-eol-d-link-products/) noted that "no exploitation reports have been published prior to CISA's warning." [The Hacker News](https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-d-link.html) wrote that there were "no details on how these shortcomings are exploited." Our searches found no later public report that ties this CVE to a specific campaign as of October 21, 2026. The attack also has a real precondition. An administrator must be logged in to the router and then load an attacker's page in the same browser. That limits it to targeted or opportunistic attacks on people who manage their own router. Enterprises rarely run DIR-600s. The realistic exposure is a forgotten unit in a small office, a lab, or a remote worker's home, where a hijacked router can redirect DNS or open remote administration. So the verdict is check exposure. Find these devices and retire them. Do not treat them as patchable. ## What to do now 1. Inventory routers in branch offices, labs and home-office kits. The hardware revision is printed on the label under the device, next to the serial number, as D-Link's advisory notes. 2. Replace any DIR-600 with a supported router. Re-flashing 2014 firmware onto an unsupported device is not a durable fix. 3. Until a unit is replaced, keep Remote Management off, which D-Link says is the default. Change the admin password, and log out of the web interface after each use. 4. Scan your public addresses for exposed admin interfaces, for example `nmap -Pn -p 80,443,8080 `, and close anything that answers from a router. ## How to tell if you were hit On any surviving unit, look for administrator accounts you did not create and check whether Remote Management has been switched on. Compare DNS servers and WAN settings against what you expect. Changed DNS is the usual sign of a hijacked consumer router. If anything is off, factory-reset the device, then replace it. ## Timeline - Jan 21, 2014 — Public disclosure date recorded in the CVE record (Dawid Czagan, InfoSec Institute). - Mar 7, 2014 — D-Link publishes SAP10018 and names firmware 2.17b02 as the fix for Rev. Bx. - Jan 13, 2015 — CVE-2014-100005 is published. - May 16, 2024 — CISA adds the CVE to KEV with a retire-and-replace action. - Jun 6, 2024 — Federal remediation deadline. ## Sources 1. [D-Link — SAP10018: DIR-600 Rev. Bx web configuration pages have CSRF vulnerabilities (F/W 2.16WW and lower)](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10018) 2. [D-Link — Legacy products: DIR-600](https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283) 3. [CVE record — CVE-2014-100005](https://www.cve.org/CVERecord?id=CVE-2014-100005) 4. [NVD — CVE-2014-100005](https://nvd.nist.gov/vuln/detail/CVE-2014-100005) 5. [CISA — Known Exploited Vulnerabilities: CVE-2014-100005](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005) 6. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 16, 2024)](https://www.cisa.gov/news-events/alerts/2024/05/16/cisa-adds-three-known-exploited-vulnerabilities-catalog) 7. [SecurityWeek — CISA Warns of Exploited Vulnerabilities in EOL D-Link Products](https://www.securityweek.com/cisa-warns-of-exploited-vulnerabilities-in-eol-d-link-products/) 8. [The Hacker News — CISA Warns of Actively Exploited D-Link Router Vulnerabilities](https://thehackernews.com/2024/05/cisa-warns-of-actively-exploited-d-link.html) --- Source page: https://erroneo.us/security/briefs/d-link-dir-600-cve-2014-100005-csrf-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt