D-Link Dir-600m Firmware vulnerabilities

6 CVEs affecting D-Link Dir-600m Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-1786, published 2024-02-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-9100, published 2017-05-21. High severity, CVSS 8.8. EPSS: 85.5% chance of exploitation in the next 30 days. login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt.
CVE-2019-13101, published 2019-08-08. Critical severity, CVSS 9.8. EPSS: 67.1% chance of exploitation in the next 30 days. An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and…
CVE-2024-1786, published 2024-02-23. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08. Affected by this issue is some unknown functionality of the component…
CVE-2019-7736, published 2019-02-11. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.
CVE-2020-13960, published 2020-06-08. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses…
CVE-2018-16605, published 2018-09-12. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.