CVE-2019-13101

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 67.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-08-08 · updated 2026-06-17
Weakness: CWE-306

Description

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.

Affected products

D-Link DIR-600M C1: 3.02, 3.03, 3.04, 3.06

References

http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html
http://seclists.org/fulldisclosure/2019/Aug/5
https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101
https://seclists.org/bugtraq/2019/Aug/17
https://us.dlink.com/en/security-advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html
http://seclists.org/fulldisclosure/2019/Aug/5
https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101
https://seclists.org/bugtraq/2019/Aug/17
https://us.dlink.com/en/security-advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf

Get alerted when CVE-2019-13101 or the next vulnerability affects your stack