CVE-2026-129353 in DIR-600L
Summary
by MITRE • 11/15/2026
A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The D-Link DIR-600L router, specifically firmware versions 2.17 and 2.17b02, contains a critical security flaw within its web management interface that allows for remote code execution through stack-based buffer overflow techniques. This vulnerability is located in the authenticationcgi_main function found within the authentication.cgi script, which serves as the primary entry point for user login procedures on the device's administrative panel. The root cause of this issue stems from insufficient bounds checking when processing input arguments related to the id and password fields. When an attacker submits a specially crafted username or password string that exceeds the expected buffer size allocated by the application, the excess data overwrites adjacent memory locations on the stack, corrupting critical control flow information such as return addresses and saved frame pointers.
This type of flaw is classically categorized under CWE-120, which denotes Buffer Copy without Checking Size of Input, a subset of broader categories like CWE-787 Out-of-bounds Write. The operational impact of this vulnerability is severe because it enables remote exploitation by an unauthenticated attacker who has network access to the router's management interface. By leveraging public exploits that are already available in the wild, adversaries can achieve arbitrary code execution on the compromised device with the privileges of the web server process, which often runs as root or a similarly privileged user in embedded Linux environments typical of consumer routers. This level of compromise allows attackers to install persistent backdoors, redirect traffic for man-in-the-middle attacks, use the router as part of a botnet such as Mirai, or pivot into internal network segments that are otherwise protected by perimeter defenses.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access and Execution via Web Services, specifically leveraging common application vulnerabilities to gain foothold in the target environment. The availability of public exploits significantly lowers the barrier for entry, making automated scanning tools likely to detect and exploit these instances rapidly across the internet. Consequently, organizations relying on this hardware model face immediate risk if they have not yet applied vendor-provided patches or mitigations.
To mitigate this risk, administrators should immediately upgrade the firmware to a version where the authenticationcgi_main function has been patched with proper input validation and length checks for all user-supplied data. If an update is unavailable, it is strongly recommended to disable remote management access entirely by restricting HTTP/HTTPS administrative interfaces to local network segments only or disabling them completely if not required. Additionally, implementing strict firewall rules that limit exposure of the router's web interface ports to trusted IP addresses can reduce the attack surface. Regular monitoring for unusual outbound traffic and unauthorized configuration changes is also advised to detect potential compromise early in the kill chain.