Skip to content
OpenAdvisories

Product · D-Link

DIR-600

6 known vulnerabilities.

DIR-600 at a glance

Last 12 months
3
Critical · all time
4
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability, 1 critical Dec 2025 January 2026: 1 vulnerability, 1 critical February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202610
Jan 202611
Dec 202511
Nov 202500
Oct 202500
Sep 202500
Aug 202522
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 4.7
    CVE-2026-2163

    D-Link DIR-600 ssdp.cgi command injection

    A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched …

    D-Link DIR-600 Network devices
  • Critical 9.3
    CVE-2026-0625

    D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

    Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, …

    D-Link DNS-320 DNS-325 DNS-345 Network devices
  • Critical 9.8
    CVE-2025-15194

    D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow

    A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow…

    D-Link DIR-600 Network devices
  • Critical 10.0
    CVE-2018-25115 EPSS 10%

    D-Link DIR-110/412/600/615/645/815 RCE via service.cgi

    Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands withou…

    D-Link DIR-615 DIR-600 DIR-645 Network devices
  • Critical 9.3
    CVE-2013-10048 Public exploit EPSS 17%

    D-Link Devices command.php Unauthenticated RCE

    An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially cr…

    D-Link DIR-600 DIR-300 Network devices
  • Medium 6.3
    CVE-2024-7357

    D-Link DIR-600 soap.cgi soapcgi_main os command injection

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgi_main of the file /soap.cgi. The manipulation of the argument service leads to os command injection. …

    D-Link DIR-600 Network devices