PT-2014-2056 · D Link · D-Link Dir-600

Dawid Czagan · Published 2014-03-07 · Updated 2024-12-20 · CVE-2014-100005

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-600 router versions prior to 2.17b02

Description The issue concerns a cross-site request forgery (CSRF) vulnerability. This vulnerability allows remote attackers to hijack the authentication of administrators for various requests, including creating an administrator account, enabling remote management via a crafted configuration module to "hedwig.cgi", activating new configuration settings via a SETCFG,SAVE,ACTIVATE action to "pigwidgeon.cgi", or sending a ping via a ping action to "diagnostic.php".

Recommendations For D-Link DIR-600 router versions prior to 2.17b02, update the firmware to version 2.17b02 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints, such as "hedwig.cgi", "pigwidgeon.cgi", and "diagnostic.php", until a patch is available. Avoid using the vulnerable configuration module and actions, such as SETCFG,SAVE,ACTIVATE and ping, in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-03952

CVE-2014-100005

Affected Products

D-Link Dir-600

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb · Exploit
• 🔥 http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access · Exploit
• https://bdu.fstec.ru/vul/2024-03952 · Security Note
• https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-100005 · Security Note
• http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018 · Vendor Advisory
• https://twitter.com/vipr_lab/status/1791805290112803117 · Twitter Post
• https://t.me/cvenotify/90394 · Telegram Post
• https://twitter.com/pinakinit1/status/1792918325825020147 · Twitter Post
• https://twitter.com/GeudiSouleiman/status/1791360207022383328 · Twitter Post
• https://twitter.com/CISACyber/status/1791123054988230687 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1791135109967729135 · Twitter Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91794 · Note
• http://secunia.com/advisories/57304 · Note
• https://twitter.com/patchnow24x7/status/1792030563349729684 · Twitter Post