D-Link DIR-600 Firmware vulnerabilities

10 CVEs affecting D-Link DIR-600 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2163, published 2026-02-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-100005: D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability, published 2015-01-13. High severity, CVSS 8.0. Actively exploited: in CISA KEV since 2024-05-16. EPSS: 43.5% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for…
CVE-2023-33625, published 2023-06-12. Critical severity, CVSS 9.8. EPSS: 33.2% chance of exploitation in the next 30 days. D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.
CVE-2013-7471, published 2019-06-11. Critical severity, CVSS 9.8. EPSS: 24% chance of exploitation in the next 30 days. An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command…
CVE-2013-10048, published 2025-08-01. Critical severity, CVSS 9.8. EPSS: 17.1% chance of exploitation in the next 30 days. An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the…
CVE-2013-10069, published 2025-08-05. Critical severity, CVSS 9.8. EPSS: 16.7% chance of exploitation in the next 30 days. The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which…
CVE-2018-25115, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days. Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows…
CVE-2026-2163, published 2026-02-08. High severity, CVSS 7.2. EPSS: 6.6% chance of exploitation in the next 30 days. A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument…
CVE-2024-7357, published 2024-08-01. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgi_main of the file /soap.cgi. The…
CVE-2023-33626, published 2023-06-12. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary.
CVE-2025-15194, published 2025-12-29. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation…