D-Link Dir-600l Firmware vulnerabilities

36 CVEs affecting D-Link Dir-600l Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42375, published 2026-05-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-8361: Realtek SDK Improper Input Validation Vulnerability, published 2015-05-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-09-18. EPSS: 100% chance of exploitation in the next 30 days. The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
CVE-2025-4350, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the argument host leads to command…
CVE-2025-4349, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is…
CVE-2025-4348, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been rated as critical. Affected by this issue is the function formSetWanL2TP. The manipulation of the argument host leads to buffer…
CVE-2025-4347, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been declared as critical. Affected by this vulnerability is the function formWlSiteSurvey. The manipulation of the argument host…
CVE-2025-4346, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been classified as critical. Affected is the function formSetWAN_Wizard534. The manipulation of the argument host leads to buffer…
CVE-2025-4345, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical. This issue affects the function formSetLog. The manipulation of the argument host leads to buffer overflow. The…
CVE-2025-4344, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01. This affects the function formLogin. The manipulation of the argument host leads to buffer overflow. It…
CVE-2025-4343, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument host leads to…
CVE-2025-4342, published 2025-05-06. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01. Affected by this issue is the function formEasySetupWizard3. The manipulation of the argument host…

Latest

CVE-2026-42375, published 2026-05-04. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static…
CVE-2026-42374, published 2026-05-04. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static…
CVE-2025-60566, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
CVE-2025-60565, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule.
CVE-2025-60564, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog.
CVE-2025-60563, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
CVE-2025-60562, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey.
CVE-2025-60561, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail.
CVE-2025-60559, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter.
CVE-2025-60558, published 2025-10-24. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ.