CVE-2019-13101 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 67.1% (pctl 99)
Patch early
A public exploit exists.
Description
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 67.09% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-306 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-08-08 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| dlink | dir-600m |
| dlink | dir-600m firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | D-Link DIR-600M - Authentication Bypass (Metasploit) | 2019-08-14 |
References
- http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html
- http://seclists.org/fulldisclosure/2019/Aug/5
- https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101
- https://seclists.org/bugtraq/2019/Aug/17
- https://us.dlink.com/en/security-advisory
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
- http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html
- http://seclists.org/fulldisclosure/2019/Aug/5
- https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101
- https://seclists.org/bugtraq/2019/Aug/17
- https://us.dlink.com/en/security-advisory
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
→ the Explorer · watch your stack · NVD