CVE-2014-100005
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
Description
CVE-2014-100005 is a high-severity cross-site request forgery (CSRF) vulnerability affecting the D-Link DIR-600 router (revision Bx) with firmware versions prior to 2.17b02. The vulnerability allows remote attackers to hijack the authentication of administrators to perform unauthorized actions, including creating new administrator accounts and enabling remote management. With a CVSS v3.1 base score of 8.8, successful exploitation grants attackers full administrative control over the router without requiring any prior authentication. CISA has added CVE-2014-100005 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 6, 2024, and its EPSS score of 40.76% at the 97.3rd percentile indicates a very high likelihood of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dir-600 firmware | <= 2.16ww |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/(Exploit, Third Party Advisory)
- http://secunia.com/advisories/57304(Broken Link)
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018(Patch, Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91794(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005(US Government Resource)
Weakness Type
Cross-Site Request Forgery (CSRF)
CVE-2014-100005 exploits multiple cross-site request forgery (CSRF) weaknesses in the D-Link DIR-600 router's web management interface. CSRF occurs when a web application does not properly verify that requests originate from a legitimate, authenticated user session rather than being forged by an external attacker. In this case, the router's hedwig.cgi and pigwidgeon.cgi endpoints accept configuration changes without validating anti-CSRF tokens or verifying the request origin. This allows an attacker to craft a malicious web page or email link that, when visited by an authenticated administrator, silently submits requests that create new admin accounts or enable remote management. This weakness is closely related to CWE-352 (Cross-Site Request Forgery), which describes the fundamental failure to verify that the source of a request matches the intended user. Learn more about CWE-352
Impact Analysis
The business impact of CVE-2014-100005 is severe, spanning all three dimensions of the CIA triad with high ratings. Confidentiality is fully compromised because an attacker who creates an administrator account or enables remote management gains access to the entire router configuration, including Wi-Fi credentials, connected device information, DNS settings, and all traffic flowing through the device.
Integrity faces maximum impact as the attacker can modify any router setting, including DNS configurations to redirect traffic to malicious servers, firewall rules to permit unauthorized access, firmware settings, and network routing tables. The ability to create new administrator accounts ensures persistent access even if the original administrator changes their password.
Availability is at high risk since the attacker can disable network services, reset the router to factory defaults, brick the device through malicious firmware updates, or configure the router to drop all traffic. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R) in the form of an administrator visiting a malicious page while authenticated. The EPSS score of 40.76% at the 97.3rd percentile places this vulnerability among the top 3% most likely to be exploited, and CISA classifies the ransomware association as "Unknown," though compromised routers are commonly used as network pivoting points in broader attack campaigns.
Exploit Maturity
CVE-2014-100005 has reached full exploit maturity with publicly documented exploitation techniques. A detailed exploit walkthrough published by Infosec Institute demonstrates the complete attack chain, including how to craft malicious HTML pages that exploit the CSRF vulnerabilities to create unauthorized administrator accounts and enable remote management on the D-Link DIR-600.
The vulnerability has been confirmed as actively exploited in the wild through CISA's inclusion in the Known Exploited Vulnerabilities catalog. Despite being discovered in 2014, the vulnerability remains relevant because many D-Link DIR-600 routers continue to operate with outdated firmware in home and small business environments. The EPSS score of 40.76% at the 97.3rd percentile confirms that exploitation activity remains significant. D-Link released a patch through security advisory SAP10018 with firmware version 2.17b02 that addresses the CSRF issues. The ransomware association is classified as "Unknown" by CISA, but the ability to gain full router control makes this vulnerability a valuable asset in multi-stage attack campaigns.
Remediation
-
Update firmware immediately to version 2.17b02 or later for D-Link DIR-600 (revision Bx) routers. The patch is available through the D-Link security advisory SAP10018 and adds CSRF protections to the web management interface.
-
Replace end-of-life devices if the DIR-600 is no longer supported by D-Link and cannot receive firmware updates. Given the age of this vulnerability (2014) and the router model, the device may have reached end-of-life status, making replacement with a modern, supported router the most secure option.
-
Disable remote management on the router's web interface to reduce the attack surface. Ensure that the management interface is only accessible from the local network and consider restricting access to specific trusted IP addresses.
-
Audit existing administrator accounts on the router to identify any unauthorized accounts that may have been created through exploitation of this vulnerability. Remove any unfamiliar accounts and change the password for all legitimate administrator accounts.
-
Implement network segmentation to limit the blast radius of a compromised router. Place IoT devices and network infrastructure on separate VLANs, and monitor for unusual configuration changes or outbound connections from the router.
Technical Details
CVE-2014-100005 exploits multiple CSRF vulnerabilities in the D-Link DIR-600 router (revision Bx) running firmware versions prior to 2.17b02. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a base score of 8.8 (High).
The attack targets the router's web management CGI endpoints, specifically hedwig.cgi and pigwidgeon.cgi. These endpoints process configuration changes submitted via HTTP POST requests but fail to implement any CSRF protection mechanisms such as anti-CSRF tokens, Referer header validation, or SameSite cookie attributes. This allows an attacker to construct malicious HTML pages containing hidden forms or JavaScript that automatically submit configuration requests when visited by an authenticated administrator.
Three distinct CSRF attack vectors have been identified: (1) Creating a new administrator account by submitting a crafted configuration module to hedwig.cgi, which adds a user with full administrative privileges. (2) Enabling remote management through a similarly crafted request to hedwig.cgi, which opens the management interface to external network access. (3) Activating configuration changes by sending a SETCFG, SAVE, ACTIVATE action sequence to pigwidgeon.cgi, which commits the unauthorized changes to the router's persistent configuration.
The Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) is low because the exploit requires only basic HTML knowledge. Privileges Required (PR:N) is none as the attacker needs no account on the router. User Interaction (UI:R) is required because an authenticated administrator must visit the attacker's malicious page. The Scope (S:U) is unchanged, and all three CIA impact metrics are rated high (C:H/I:H/A:H) because successful exploitation provides complete administrative control over the device.
Frequently Asked Questions
What is CVE-2014-100005?
CVE-2014-100005 is a cross-site request forgery (CSRF) vulnerability in D-Link DIR-600 routers with firmware prior to version 2.17b02. It allows attackers to hijack administrator sessions to create rogue admin accounts and enable remote management on the device.
How is CVE-2014-100005 exploited?
An attacker creates a malicious web page containing hidden forms targeting the router's management interface. When an authenticated administrator visits this page, the browser automatically submits configuration change requests to the router, which processes them as legitimate because no CSRF tokens are required.
Is my D-Link DIR-600 affected?
If your D-Link DIR-600 (revision Bx) is running firmware older than version 2.17b02, it is vulnerable. Check your firmware version in the router's web management interface and update to 2.17b02 or later.
Why is a vulnerability from 2014 still relevant?
Many legacy routers remain in service with outdated firmware. CISA added this CVE to the KEV catalog in 2024, confirming ongoing exploitation. The DIR-600's long deployment lifecycle and the trivial nature of the exploit make it a persistent threat in environments that have not upgraded their networking equipment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.