---
id: "CVE-2026-129353"
page: "https://infrastack.ai/live/CVE-2026-129353"
kind: "vulnerability"
aliases: ["CVE-2026-129353"]
title: "D-Link DIR-600L router: stack overflow in login handler lets remote attackers in"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DIR-600L", "fixed": [], "affected": "2.17, 2.17b02", "ecosystem": "firmware"}]
ecosystems: []
tags: ["d-link", "dir-600l", "end-of-life", "firmware", "home-router", "infrastructure"]
not_affected_if: ["admin-interface-not-exposed", "other-firmware", "other-models"]
published_at: "2026-11-15T00:16:51+00:00"
first_seen_at: "2026-11-15T00:32:23+00:00"
updated_at: "2026-11-15T00:34:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129353", "first_seen_at": "2026-11-15T00:32:23+00:00"}, {"source": "analyst", "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499", "first_seen_at": "2026-11-15T00:34:15+00:00", "cites": ["https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499", "https://vuldb.com/vuln/437416"]}]
exploit_sources: [{"type": "poc", "url": "https://vuldb.com/vuln/437416"}]
---

# D-Link DIR-600L router: stack overflow in login handler lets remote attackers in

Link for people: https://infrastack.ai/live/CVE-2026-129353 (this .md is for agents)

The D-Link DIR-600L router's authentication.cgi login handler has a stack-based buffer overflow when the id or password argument is manipulated. A remote attacker can exploit it over the network, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:DIR-600L affected 2.17, 2.17b02 fixed no fixed version listed

## How to check

- Find the model and firmware on the router's admin page or its label: DIR-600L with firmware 2.17 or 2.17b02 is named as affected (VulDB). Other firmware versions are not confirmed either way.
- Check whether the router's web admin interface is reachable from the internet (remote management enabled). VulDB says no authentication is needed, so any host that can reach the web interface can attempt it.
- Also check any other legacy D-Link DIR-series routers; D-Link lists many as EOL.

## Fix

No fix: D-Link lists DIR-600L (RevB) as end-of-life since 12/01/2016 and says no firmware updates or hotfixes will be released; it recommends retiring and replacing the device (SAP10499, a general EOL notice, not specific to this CVE).

## Timeline

- 2026-11-15T00:32:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129353
- 2026-11-15T00:34:15+00:00 analyst https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499 — VulDB (CNA) page read: unauth remote stack overflow, PoC public on github (link not shown), no known exploitation. D-Link SAP10499 says DIR-600L RevB EOL 2016, no firmware updates; fix marked none/verified from that general EOL page. Did not find a D-Link advisory specific to this CVE. X not checked.

## Documents

- [advisory] D-Link SAP10499: legacy DIR-series EOL/EOS, DIR-600L RevB EOL 12/01/2016, no firmware updates https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10499
- [poc] VulDB VDB-437416: DIR-600L authenticationcgi_main stack overflow (PoC public) https://vuldb.com/vuln/437416

## From the sources

A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_