CVE-2014-100005

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.0CVSS 3.1, Highfrom CISA (ADP container)CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

• This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Jan 2015 Published
2. 16 May 2024 CVE-2014-100005 added to CISA KEV
3. 16 May 2024 Added to the CISA KEV catalogue

Weakness

• CWE-352

References

• 57304third-party-advisoryx_refsource_SECUNIA
• dir600-settings-csrf(91794)vdb-entryx_refsource_XF
• resources.infosecinstitute.comx_refsource_MISC
• securityadvisories.dlink.comx_refsource_CONFIRM