CVE-2026-2163 - Vulnerability Details

- D-Link DIR-600 ssdp.cgi command injection

Description

A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Published: 2026-02-08

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the ssdp.cgi component of the D-Link DIR-600 router allows an attacker to alter the HTTP_ST, REMOTE_ADDR, REMOTE_PORT, or SERVER_ID arguments, resulting in command injection that can execute arbitrary commands on the device. This injection is based on improper handling of user-supplied input (see CWE‑74 and CWE‑77). The vulnerability can compromise the confidentiality, integrity, and availability of the affected router and may be leveraged to gain further network access or deploy malware.

Affected Systems

The vulnerability affects the D-Link DIR-600 router model, specifically firmware versions up to 2.15WWb02. Devices running these firmware releases are at risk, and the affected units are no longer supported by the manufacturer.

Risk and Exploitability

The CVSS v3.1 score of 5.1 indicates moderate severity. The EPSS probability of exploitation is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via HTTP requests without authentication. Once the vulnerability is triggered, an attacker can execute any command defined on the router, potentially taking full control of the device.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

D-Link

DIR-600

affected

Version	Status	Constraints
`2.15WWb02`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:dlink:dir-600_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dlink:dir-600:-:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
D-link	Dir-600	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the router firmware to the latest supported release (e.g., any version above 2.15WWb02).
Disable or block access to the ssdp.cgi service or the relevant network ports if the firmware update is unavailable.
Implement input validation on the HTTP arguments used by ssdp.cgi, ensuring that only expected, sanitized values are accepted, and restrict command execution to essential privileged processes.

Generated by OpenCVE AI on April 17, 2026 at 21:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00072.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md
https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc
https://vuldb.com/?ctiid.344865
https://vuldb.com/?id.344865
https://vuldb.com/?submit.751764
https://www.dlink.com/

History

Wed, 11 Feb 2026 18:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dlink Dlink dir-600 Dlink dir-600 Firmware
CPEs		cpe:2.3:h:dlink:dir-600:-:::::::* cpe:2.3:o:dlink:dir-600_firmware::::::::
Vendors & Products		Dlink Dlink dir-600 Dlink dir-600 Firmware

Mon, 09 Feb 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Feb 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		D-link D-link dir-600
Vendors & Products		D-link D-link dir-600

Sun, 08 Feb 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Title		D-Link DIR-600 ssdp.cgi command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91600.md#poc https://vuldb.com/?ctiid.344865 https://vuldb.com/?id.344865 https://vuldb.com/?submit.751764 https://www.dlink.com/
Metrics		cvssV2_0 `{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

D-link Dir-600

Dlink Dir-600 Dir-600 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-08T16:32:09.507Z

Updated: 2026-02-23T09:44:29.113Z

Reserved: 2026-02-07T09:06:36.248Z

Link: CVE-2026-2163

Vulnrichment

Updated: 2026-02-09T21:15:31.351Z

NVD

Status : Analyzed

Published: 2026-02-08T17:15:58.210

Modified: 2026-02-11T18:43:40.487

Link: CVE-2026-2163

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T22:00:11Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object