CVE-2026-2163 - Vulnerability Details

- D-Link DIR-600 ssdp.cgi command injection

Description

A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Published: 2026-02-08

Score: 5.1 Medium

EPSS: 5.2% Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the ssdp.cgi component of the D‑Link DIR‑600 router allows an attacker to manipulate the HTTP_ST, REMOTE_ADDR, REMOTE_PORT, or SERVER_ID arguments, resulting in arbitrary command execution on the device. The vulnerability arises from improper handling of user‑supplied input, as indicated by the referenced CWEs. The attack may be launched remotely via HTTP requests directed at ssdp.cgi, and publicly available exploits exist.

Affected Systems

The vulnerability affects D‑Link DIR‑600 routers running firmware versions up to 2.15WWb02. Devices with these firmware releases are at risk; these firmware builds are no longer supported by the manufacturer.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of 5% shows a low but measurable probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through crafted HTTP requests to ssdp.cgi; although the description does not state whether authentication is required, the wording suggests that no prior authentication is necessary for the exploit.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

D-Link

DIR-600

affected

Version	Status	Constraints
`2.15WWb02`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
D-link	Dir-600	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the router firmware to any release newer than 2.15WWb02.
If a firmware upgrade is unavailable, block or disable access to the ssdp.cgi service on the device.
Configure network segmentation or a separate VLAN to isolate the router from critical assets, limiting potential lateral movement if exploitation occurs.

Generated by OpenCVE AI on June 18, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.05172.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md
https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc
https://vuldb.com/?ctiid.344865
https://vuldb.com/?id.344865
https://vuldb.com/?submit.751764
https://www.dlink.com/

History

Wed, 11 Feb 2026 18:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dlink Dlink dir-600 Dlink dir-600 Firmware
CPEs		cpe:2.3:h:dlink:dir-600:-:::::::* cpe:2.3:o:dlink:dir-600_firmware::::::::
Vendors & Products		Dlink Dlink dir-600 Dlink dir-600 Firmware

Mon, 09 Feb 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Feb 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		D-link D-link dir-600
Vendors & Products		D-link D-link dir-600

Sun, 08 Feb 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Title		D-Link DIR-600 ssdp.cgi command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc https://vuldb.com/?ctiid.344865 https://vuldb.com/?id.344865 https://vuldb.com/?submit.751764 https://www.dlink.com/
Metrics		cvssV2_0 `{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

D-link Dir-600

Dlink Dir-600 Dir-600 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-08T16:32:09.507Z

Updated: 2026-02-23T09:44:29.113Z

Reserved: 2026-02-07T09:06:36.248Z

Link: CVE-2026-2163

Vulnrichment

Updated: 2026-02-09T21:15:31.351Z

NVD

Status : Analyzed

Published: 2026-02-08T17:15:58.210

Modified: 2026-06-17T10:30:26.833

Link: CVE-2026-2163

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-18T05:15:16Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object