CVE-2014-100005 in dlink dir-600 firmware
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
Affected software: dlink dir-600 firmware
Scores
- CVSS: 8.0 (high)
- EPSS: 43.46% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2024-05-16
- Published: 2015-01-13
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Replace end-of-life D-Link NAS, DSL-2750B and DIR-600 devices (CVE-2024-3272, CVE-2024-3273, CVE-2016-20017, CVE-2014-100005)
Isolate the system. D-Link will not patch these end-of-life devices; replacing them, or at least taking their web interface off the internet, is the only way to remove the risk.
Applies to: End-of-life D-Link NAS models, DSL-2750B and DIR-600 routers
- Find the affected D-Link NAS (DNS-320L, DNS-325, DNS-327L, DNS-340L and similar), DSL-2750B and DIR-600 devices in your inventory.
- Plan a replacement with a supported device.
- Until then, make sure the web interface is not reachable from the internet and change default and shared credentials.
- Move remaining devices into an isolated network segment.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.