CVE-2019-13101

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Aug/5Mailing List, Third Party Advisory
https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101Third Party Advisory
https://seclists.org/bugtraq/2019/Aug/17Mailing List, Third Party Advisory
https://us.dlink.com/en/security-advisoryVendor Advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfThird Party Advisory, US Government Resource
http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Aug/5Mailing List, Third Party Advisory
https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101Third Party Advisory
https://seclists.org/bugtraq/2019/Aug/17Mailing List, Third Party Advisory
https://us.dlink.com/en/security-advisoryVendor Advisory
https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfThird Party Advisory, US Government Resource

Timeline

Published: Aug 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-131037.1A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the sta CVE-2019-131047.8In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including CVE-2019-131057.8Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem.CVE-2019-131067.8Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack CVE-2019-131079.8Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c CVE-2019-131086.5An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because CVE-2019-131096.5An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because CVE-2019-13117.8A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Rem CVE-2019-131106.5A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of servi CVE-2019-131115.5A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation fo CVE-2019-131126.5A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash CVE-2019-131136.5Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW