CVE-2019-13101
CVE-2019-13101
Vexday Risk Score
72High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 67.1%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
08 Aug 2019Published on NVD
14 Aug 2019Public PoC
Weaponization speed
5 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Patch as soon as possible — active exploitation confirmed.
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
Affected products
n/a · n/apublic PoCs found — 4
githubgithub.com/halencarjunior/dlkploit600★ 0cve_referencepacketstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlunverifiedexploitdbwww.exploit-db.com/exploits/47250unverifiedvulncheckvulncheck.com/xdb/ddba45e2c1ebunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlhttp://seclists.org/fulldisclosure/2019/Aug/5https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101https://seclists.org/bugtraq/2019/Aug/17https://us.dlink.com/en/security-advisoryhttps://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf