DIR-600L · CVE-2026-129353 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The D-Link DIR-600L router's authentication.cgi login handler has a stack-based buffer overflow when the id or password argument is manipulated. A remote attacker can exploit it over the network, and a public exploit exists.
first public Nov 15, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of D-Link DIR-600L routers running firmware 2.17 or 2.17b02 are named as affected by VulDB. The flaw is in the login handler authentication.cgi and needs no authentication; a public proof of concept exists, so exposure is highest where the web admin interface is reachable from the internet. D-Link lists the DIR-600L as end of life, so no patch is expected; owners of other models can skip it.
Not affected if admin-interface-not-exposed, other-firmware, other-models
Who cares d-link, dir-600l, end-of-life, firmware, home-router
No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).
A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.