{"id":"CVE-2026-129353","kind":"vulnerability","aliases":["CVE-2026-129353"],"related":[],"title":"D-Link DIR-600L router: stack overflow in login handler lets remote attackers in","description":"A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.","summary":"The D-Link DIR-600L router's authentication.cgi login handler has a stack-based buffer overflow when the id or password argument is manipulated. A remote attacker can exploit it over the network, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-600L","fixed":[],"affected":"2.17, 2.17b02","ecosystem":"firmware"}],"ecosystems":[],"tags":["d-link","dir-600l","end-of-life","firmware","home-router","infrastructure"],"not_affected_if":["admin-interface-not-exposed","other-firmware","other-models"],"how_to_check":"- Find the model and firmware on the router's admin page or its label: DIR-600L with firmware 2.17 or 2.17b02 is named as affected (VulDB). Other firmware versions are not confirmed either way.\n- Check whether the router's web admin interface is reachable from the internet (remote management enabled). VulDB says no authentication is needed, so any host that can reach the web interface can attempt it.\n- Also check any other legacy D-Link DIR-series routers; D-Link lists many as EOL.","fix":"No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).","status":"open","published_at":"2026-11-15T00:16:51+00:00","first_seen_at":"2026-11-15T00:32:23+00:00","triaged_at":"2026-11-15T00:33:18+00:00","updated_at":"2026-11-15T00:34:15+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-15T00:33:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-600L router: stack overflow in login handler lets remote attackers in","impact":"high","summary":"The D-Link DIR-600L router's authentication.cgi login handler has a stack-based buffer overflow when the id or password argument is manipulated. A remote attacker can exploit it over the network, and a public exploit exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-600l","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs code on the router and takes over the network","analyst_note":"Check the vendor's D-Link security advisory for a fixed firmware and confirm whether the web interface is exposed by default.","how_to_check":"- Check the firmware version on the router's admin page; versions `2.17` and `2.17b02` are named as affected.\n- Check whether the router's web admin interface is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-models","other-firmware","admin-interface-not-exposed"],"who_is_affected":"Owners of D-Link DIR-600L routers running firmware 2.17 or 2.17b02 are named as affected. Exposure is highest where the router's web administration interface is reachable from outside the local network. The sources do not say whether a fixed firmware exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000723,"input_tokens":4565,"output_tokens":533,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor's D-Link security advisory for a fixed firmware and confirm whether the web interface is exposed by default.","search":"'-129353':18A,21A '-2026':17A,20A '/2.17b02':93C '2.17':92C '600l':6A,24A,30B,46B,91C 'affect':94C 'argument':64B,112C 'attack':15A,69B,125C 'authentication.cgi':49B,106C 'authenticationcgi':101C 'base':56B,118C 'buffer':57B,119C 'cve':16A,19A 'd':2A,26B,42B,87C 'd-link':1A,25B,41B,86C 'detect':84C 'dir':5A,23A,29B,45B,90C 'dir-600l':4A,22A,28B,44B,89C 'end':32B 'end-of-lif':31B 'exist':80B 'exploit':71B,79B,122C,129C 'file':105C 'firmwar':35B 'function':100C 'handler':12A,51B 'home':37B 'home-rout':36B 'id':61B 'id/password':113C 'infrastructur':39B 'let':13A 'life':34B 'link':3A,27B,43B,88C 'login':11A,50B 'main':102C 'manipul':66B,109C 'may':134C 'network':75B 'overflow':9A,58B,120C 'password':63B 'perform':107C 'possibl':127C 'public':78B,132C 'remot':14A,68B,121C 'result':114C 'router':7A,38B,47B 'stack':8A,55B,117C 'stack-bas':54B,116C 'use':136C 'vulner':82C,97C","nicknames":[],"mitigations":[],"who_affected":"Owners of D-Link DIR-600L routers running firmware 2.17 or 2.17b02 are named as affected by VulDB. The flaw is in the login handler authentication.cgi and needs no authentication; a public proof of concept exists, so exposure is highest where the web admin interface is reachable from the internet. D-Link lists the DIR-600L as end of life, so no patch is expected; owners of other models can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-15T00:34:15Z","by":"analyst","doc":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","run_id":4010}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use a D-Link DIR-600L router, replace it with a currently supported router, because D-Link no longer provides updates for it.","pkeys":["dir600l"],"ptokens":["600l","dir"],"labels":["critical","dir600l","dlink","endoflife","firmware","homerouter","infrastructure"],"campaign_type":null,"search_a":"'-129353':18A,21A '-2026':17A,20A '600l':6A,24A 'attack':15A 'cve':16A,19A 'd':2A 'd-link':1A 'dir':5A,23A 'dir-600l':4A,22A 'handler':12A 'let':13A 'link':3A 'login':11A 'overflow':9A 'remot':14A 'router':7A 'stack':8A","search_b":"'600l':30B,46B 'argument':64B 'attack':69B 'authentication.cgi':49B 'base':56B 'buffer':57B 'd':26B,42B 'd-link':25B,41B 'dir':29B,45B 'dir-600l':28B,44B 'end':32B 'end-of-lif':31B 'exist':80B 'exploit':71B,79B 'firmwar':35B 'handler':51B 'home':37B 'home-rout':36B 'id':61B 'infrastructur':39B 'life':34B 'link':27B,43B 'login':50B 'manipul':66B 'network':75B 'overflow':58B 'password':63B 'public':78B 'remot':68B 'router':38B,47B 'stack':55B 'stack-bas':54B","search_c":"'/2.17b02':93C '2.17':92C '600l':91C 'affect':94C 'argument':112C 'attack':125C 'authentication.cgi':106C 'authenticationcgi':101C 'base':118C 'buffer':119C 'd':87C 'd-link':86C 'detect':84C 'dir':90C 'dir-600l':89C 'exploit':122C,129C 'file':105C 'function':100C 'id/password':113C 'link':88C 'main':102C 'manipul':109C 'may':134C 'overflow':120C 'perform':107C 'possibl':127C 'public':132C 'remot':121C 'result':114C 'stack':117C 'stack-bas':116C 'use':136C 'vulner':82C,97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T00:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-129353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129353","severity":null,"published_at":"2026-11-15T00:16:51+00:00","modified_at":"2026-11-15T00:16:51+00:00","first_seen_at":"2026-11-15T00:32:23+00:00","fetched_at":"2026-11-15T00:32:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129353:4010","url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","severity":null,"published_at":"2026-11-15T00:34:15+00:00","modified_at":"2026-11-15T00:34:15+00:00","first_seen_at":"2026-11-15T00:34:15+00:00","fetched_at":"2026-11-15T00:34:15+00:00","note":"VulDB (CNA) page read: unauth remote stack overflow, PoC public on github (link not shown), no known exploitation. D-Link SAP10499 says DIR-600L RevB EOL 2016, no firmware updates; fix marked none/verified from that general EOL page. Did not find a D-Link advisory specific to this CVE. X not checked.","cites":["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","https://vuldb.com/vuln/437416"]}],"documents":[{"id":159547,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499","title":"D-Link SAP10499: legacy DIR-series EOL/EOS, DIR-600L RevB EOL 12/01/2016, no firmware updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":159548,"url":"https://vuldb.com/vuln/437416","title":"VulDB VDB-437416: DIR-600L authenticationcgi_main stack overflow (PoC public)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vuldb.com/vuln/437416"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}