PT-2026-6994 · D Link · Dir-600M

Lontan0 · Publicado 2026-02-04 · Atualizado 2026-02-08 · CVE-2026-2163

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-600 versions prior to 2.15WWb02

Description A flaw exists in D-Link DIR-600 firmware up to version 2.15WWb02 related to the ssdp.cgi file. Manipulation of the HTTP ST/REMOTE ADDR/REMOTE PORT/SERVER ID argument can lead to command injection. This issue is remotely exploitable. The exploit is publicly available. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations Update to a version prior to 2.15WWb02.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2026-02473

CVE-2026-2163

Produtos afetados

Dir-600M

Referências · 12

• 🔥 https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc · Exploit
• 🔥 https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md · Exploit
• https://vuldb.com/?submit.751764 · Nota
• https://t.me/CVEtracker/44112 · Publicação no Telegram
• https://dlink.com · Nota
• https://bdu.fstec.ru/vul/2026-02473 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020549131379323114 · Publicação no Twitter
• https://t.me/cveNotify/151310 · Publicação no Telegram
• https://vuldb.com/?ctiid.344865 · Nota
• https://vuldb.com/?id.344865 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2163 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-2163 · Aviso do Fabricante