{"id":"CVE-2014-100005","published":"2015-01-13T11:59:04Z","modified":"2026-06-17T00:04:00Z","title":"D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability","vendor":"D-Link","product":"DIR-600 Router","tier":"core","eol":null,"description":{"text":"Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.","provenance":"source","from":"NVD"},"summary":{"text":"The D-Link DIR-600 router (hardware revision Bx) running firmware before 2.17b02 contains multiple cross-site request forgery flaws in its web configuration interface, affecting the hedwig.cgi, pigwidgeon.cgi and diagnostic.php handlers. An attacker on an adjacent network who can get an authenticated administrator to visit a crafted page can hijack that session to create an administrator account, enable remote management, activate configuration changes, or trigger a ping.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:35Z"},"cvss":{"score":8.0,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.43456,"percentile":0.98737,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-05-16","dueDate":"2024-06-06","ransomware":false,"requiredAction":"This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.","notes":"https://legacy.us.dlink.com/pages/product.aspx?id=4587b63118524aec911191cc81605283; https://nvd.nist.gov/vuln/detail/CVE-2014-100005","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-05-16","exploitedFirstSeen":"2024-05-16","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-05-16"},{"url":"https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack","date":"2024-05-24"},{"url":"https://www.forescout.com/resources/2024h1-threat-review/","date":"2024-08-29"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/","tags":["Exploit","Third Party Advisory"]},{"url":"http://secunia.com/advisories/57304","tags":["Broken Link"]},{"url":"http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91794","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/","tags":["Exploit","Third Party Advisory"]},{"url":"http://secunia.com/advisories/57304","tags":["Broken Link"]},{"url":"http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018","tags":["Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91794","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: CSRF lures authenticated admin into triggering requests","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow remote attackers to hijack the authentication of administrators","start":123,"end":192}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Forged config changes and ping action run device commands","mappingType":"primary_impact","evidence":[{"from":"description","quote":"activate new configuration settings via a SETCFG,SAVE,ACTIVATE action","start":333,"end":402}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Creates admin account and enables remote management access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"create an administrator account or (2) enable remote management","start":215,"end":278}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-1036","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1036","exploited":true,"exploitedSince":"2024-05-16","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"D-Link DIR-645 / DIR-815 diagnostic.php Command Execution","module":"exploit/linux/http/dlink_diagnostic_exec_noauth","type":"exploit","disclosureDate":"2013-03-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb"}],"first":{"date":"2013-03-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb"},"provenance":"source"},"exploitRefs":["http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/"],"flow":[{"stage":"exploitation","techniques":["T1204.001"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1098"],"provenance":"ai"}],"timeline":[{"date":"2013-03-05","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb","provenance":"source"},{"date":"2015-01-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-100005","provenance":"source"},{"date":"2024-05-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-05-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1036","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3411},"priority":{"score":68.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 898 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.75,"detail":"percentile 0.9874"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}