CVE-2014-100005 D-Link DIR-600 Router Cross-Site Request Forgery (CSRF)

Exploited in the wild High 8.0 Published 13 Jan 2015 Updated 22 Oct 2025

Remote attackers can hijack administrator sessions to create accounts or enable remote management on D-Link DIR-600 routers via CSRF vulnerabilities.

Exploited in the wild: Since 16 May 2024
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-100005?

CVE-2014-100005 is a high-severity vulnerability in n/a, published on 13 Jan 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

Weakness: CWE-352

Which versions are affected by CVE-2014-100005?

It affects 1 product.

Products include Dlink Dir-600 Firmware.

How do I fix CVE-2014-100005?

No fix has been published for CVE-2014-100005 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Jun 2024.

Is CVE-2014-100005 being exploited?

Yes. Attackers have exploited CVE-2014-100005 in the wild since at least 16 May 2024.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-ppfw-543c-9q84.