CVE-2013-3095

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-11-20 · updated 2026-06-16
Weakness: CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. A1) with firmware before 1.05b07 allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password or (2) enable remote management via a request to hedwig.cgi or (3) activate configuration changes via a request to pigwidgeon.cgi.

Affected products

Dlink Dir865L: all versions
Dlink Dir865L Firmware: through 1.05; 1.00b24, 1.02, 1.03

References

http://secunia.com/advisories/53064
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10003
http://securityevaluators.com/content/case-studies/routers/dlink_dir865l.jsp
http://secunia.com/advisories/53064
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10003
http://securityevaluators.com/content/case-studies/routers/dlink_dir865l.jsp

Get alerted when CVE-2013-3095 or the next vulnerability affects your stack