PT-2026-43097 · D Link · Dir601

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25358

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DIR601 version 2.02NA

Description A credential disclosure issue allows unauthenticated attackers to retrieve sensitive configuration data. By manipulating the table name parameter in POST requests sent to the '/my cgi.cgi' endpoint, attackers can extract administrative credentials and wireless network keys in clear text. Examples of values for the table name parameter include admin user, wireless settings, and wireless security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2018-25358

Affected Products

Dir601

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-25358 · Security Note
• https://exploit-db.com/exploits/45002 · Note
• https://packetlabs.net · Note
• http://ca.dlink.com · Note
• https://t.me/CVEtracker/54734 · Telegram Post
• http://support.dlink.ca/ProductInfo.aspx?m=DIR-601 · Note
• https://vulncheck.com/advisories/d-link-dir601-2-02na-credential-disclosure-via-my-cgi-cgi · Note