Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-129353: D-Link DIR-600L can be remotely compromised via login
CVE-2026-129353 · published today
Summary
The DIR-600L router's login function can overflow its memory when a specially crafted username or password is sent, allowing an attacker to run code on the device from anywhere on the internet. A public exploit exists, so the risk is real. Apply the latest firmware from D‑Link or disable remote management until the update is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| d-link | dir-600l | 2.17 |
Original advisory text
D-Link DIR-600L authentication.cgi authenticationcgi_main stack-based overflow
A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
References
- https://vuldb.com/vuln/437416 vdb-entry technical-description
- https://vuldb.com/vuln/437416/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-129353 third-party-advisory
- https://vuldb.com/submit/1043523 third-party-advisory
- https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/route... exploit
- https://www.dlink.com/ product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-121Stack-based Buffer Overflow
CWE-119Buffer Overflow
Timeline
Published14 Nov 2026
Updated14 Nov 2026
First seen14 Nov 2026
Track software like this
Free during beta