D-Link DIR-600 CVE-2025-15194

No special software configuration is required within the application logic - exploitation needs only network access to the DIR-600 HTTP management service and a crafted request to hedwig.cgi with a malicious Cookie header (per CVSS PR:N/UI:N/AC:L, unauthenticated with no user interaction). The practical limiting factor is reachability: consumer router management interfaces are typically bound to the LAN by default, so internet-facing exploitation requires remote administration to be enabled/exposed to the WAN. A further constraint is scope - only DIR-600 firmware up to 2.15WWb02 is affected, and because the product is end-of-life, no vendor fix is available (mitigation relies on network isolation or device replacement).

Multiple signals point to a genuinely exploitable flaw of elevated concern, though real-world priority is tempered by product status and exposure assumptions. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.9) describes a network-reachable, low-complexity, unauthenticated stack-based buffer overflow with high confidentiality, integrity, and availability impact - consistent with remote code execution on the device. The E:P marker and the provided GitHub reference confirm publicly available exploit code exists, but this is NOT confirmed active exploitation: the CVE is NOT listed in CISA KEV, and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted from the data. Note the description states the product 'is no longer supported by the maintainer' (end-of-life), meaning no official patch will be issued - this raises residual risk for any still-deployed units while simultaneously shrinking the exploitable population over time. A key caveat: the overflow is reached via the HTTP management interface, which on consumer routers is typically LAN-facing by default; internet-wide exploitation depends on remote administration being exposed to the WAN, which the data does not confirm. Overall this is a credible, real (not merely high-CVSS-paper) issue with working PoC, but likely opportunistic/targeted rather than mass-exploited given the EOL consumer footprint and uncertain WAN exposure.

An attacker with reachability to the DIR-600 web management interface sends a crafted HTTP request to hedwig.cgi containing an oversized Cookie header, overflowing a stack buffer in the HTTP Header Handler to hijack control flow and execute attacker-controlled code on the router. Public exploit code is available (GitHub PoC referenced), and because CVSS indicates no authentication or user interaction is required (PR:N/UI:N) with low complexity (AC:L), a successful attempt needs only network access to the management service.