CVE-2025-15194criticalCWE-119CWE-121

CVE-2025-15194: fallo crítico en D-Link DIR-600

D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow

Publicada el

Seguir esta CVE+ Monitorear DIR-600

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 9.3epss 1.2%
A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
D-Link · DIR-600
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — D-Link DIR-600

En el mismo producto, de las más peligrosas a las menos.

CVE-2013-10048CRITICALD-Link Devices command.php Unauthenticated RCEEPSS 16.6%CVE-2018-25115CRITICALD-Link DIR-110/412/600/615/645/815 RCE via service.cgiEPSS 10.4%CVE-2026-2163MEDIUMD-Link DIR-600 ssdp.cgi command injectionEPSS 6.6%CVE-2024-7357MEDIUMD-Link DIR-600 soap.cgi soapcgi_main os command injectionEPSS 5.7%CVE-2026-0625CRITICALD-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration EndpointEPSS 1.0%