D-Link Dir-600m Firmware vulnerabilities

2 CVEs affecting D-Link Dir-600m Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-10676, published 2017-07-20.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-10676, published 2017-07-20. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter.
• CVE-2017-5874, published 2017-03-22. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact.