D-Link DIR-600L CVE-2026-129353

The attacker needs network access to the device's HTTP management interface and must reach the authentication.cgi endpoint; exploitation requires sending a manipulated id and/or password argument to the authenticationcgi_main function. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, so default-configured, network-exposed DIR-600L devices running 2.17/2.17b02 are at risk. The principal limiting factors are reachability of the web interface (devices not exposing management to the attacker's network segment, e.g. WAN-side management disabled, are not remotely reachable) and the narrow, end-of-life affected product/version scope; the precise input size/encoding that triggers the overflow is not described in the available sources.

Multiple signals converge on genuine priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, pre-authentication flaw, and with PR:N the input supports an unauthenticated attacker - consistent with the affected endpoint being the login handler (authentication.cgi), which is reachable before any credentials are supplied. The vuln.today Decision label is act_now and a public PoC reference exists, which together argue against treating this as a paper-only high-CVSS issue. Two signals temper that: the PoC reference is not verified as working exploit code, and there is NO CISA KEV listing and NO EPSS score in the input, so there is no confirmation of active or widespread exploitation - the act_now label reflects the pre-auth RCE profile plus public PoC, not observed in-the-wild activity. The 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H) imply compromise beyond the vulnerable component; this is plausible for a router whose web service runs with high privilege, but the input does not describe the mechanism, so it is not independently confirmed. Net: a real, high-urgency issue for anyone running this device, moderated by the fact that exploitation is demonstrated only by an unverified PoC and the product is end-of-life/consumer-grade rather than widely deployed in enterprises.

A remote attacker sends a crafted request to authentication.cgi with an oversized or malformed id/password argument, overflowing a stack buffer in authenticationcgi_main before authentication completes. Given AV:N/AC:L/PR:N, this is reachable over the network without credentials and can lead to code execution on the device. A public PoC reference exists but is not verified as working exploit code, so reliability of a weaponized exploit is unconfirmed.