Dir 600L
Monthly
Remote, unauthenticated stack-based buffer overflow in the HNAP handler (cgibin hnap_main) of D-Link DIR-600L firmware 2.17b02. A network-reachable attacker who can send crafted HNAP/SOAP requests to the device's web management interface can overwrite stack memory, potentially achieving code execution with the privileges of the HTTP service; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impacts High) matches this worst case, and the realistic exposure scenario is a router with the HNAP/HTTP interface reachable from the WAN, while LAN-only deployments confine attackers to the local segment. A public advisory with exploit reference material has been published (a GitHub router-firmware advisory), and vuln.today prioritizes the issue as act_now, though the PoC is a reference not verified as working exploit code and no CISA KEV entry is reported.
Remote, unauthenticated stack-based buffer overflow in the authentication.cgi handler of D-Link DIR-600L firmware 2.17/2.17b02 allows an attacker who can reach the device's HTTP management interface to corrupt stack memory through crafted id and/or password arguments, with assessed impact of high confidentiality, integrity and availability loss (CVSS 9.3, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N). No authentication or user interaction is required per both the published and the independently assessed vectors, so any DIR-600L running those builds with its web interface exposed to an untrusted network segment is reachable. A public PoC reference exists (a GitHub router-firmware advisory) but is not verified as working exploit code, there is no CISA KEV confirmation of active exploitation, and the current decision signal is act_now, driven by the critical severity and the narrow, end-of-life product scope rather than by confirmed in-the-wild use.
Remote, unauthenticated stack-based buffer overflow in the HNAP handler (cgibin hnap_main) of D-Link DIR-600L firmware 2.17b02. A network-reachable attacker who can send crafted HNAP/SOAP requests to the device's web management interface can overwrite stack memory, potentially achieving code execution with the privileges of the HTTP service; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impacts High) matches this worst case, and the realistic exposure scenario is a router with the HNAP/HTTP interface reachable from the WAN, while LAN-only deployments confine attackers to the local segment. A public advisory with exploit reference material has been published (a GitHub router-firmware advisory), and vuln.today prioritizes the issue as act_now, though the PoC is a reference not verified as working exploit code and no CISA KEV entry is reported.
Remote, unauthenticated stack-based buffer overflow in the authentication.cgi handler of D-Link DIR-600L firmware 2.17/2.17b02 allows an attacker who can reach the device's HTTP management interface to corrupt stack memory through crafted id and/or password arguments, with assessed impact of high confidentiality, integrity and availability loss (CVSS 9.3, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N). No authentication or user interaction is required per both the published and the independently assessed vectors, so any DIR-600L running those builds with its web interface exposed to an untrusted network segment is reachable. A public PoC reference exists (a GitHub router-firmware advisory) but is not verified as working exploit code, there is no CISA KEV confirmation of active exploitation, and the current decision signal is act_now, driven by the critical severity and the narrow, end-of-life product scope rather than by confirmed in-the-wild use.