Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

D-Link DIR-601 router can be controlled remotely

CVE-2019-16326 · published 6 years ago
Summary

The firmware on D-Link DIR-601 routers does not check a special security code when processing web requests, making it possible for a distant attacker to trick the router into performing actions it should not. Combined with another weakness, this could let the attacker take over the router and change its settings. Replace the device with a supported model or disconnect it from the network until it can be removed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dlink dir-601_firmware 2.00na
cpe:2.3:o:dlink:dir-601_firmware:2.00na:*:*:*:*:*:*:*
Original advisory text
D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and ...
D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and device compromise. NOTE: this is an end-of-life product.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published26 Dec 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-16326 · NVD
Track software like this
Free during beta