CVE-2014-100005

What Is the D-Link DIR-600?

The D-Link DIR-600 is a consumer and small business wireless router sold from approximately 2009 through the mid-2010s. Like most consumer routers of this era, it provides NAT, DHCP, wireless AP, and a web-based administration interface. The DIR-600 was widely deployed in homes and small offices, and — critically — was never designed with enterprise security requirements in mind. D-Link declared the DIR-600 end-of-life with no further firmware updates available.

Consumer routers are high-value targets for attackers: they sit at the network perimeter of homes and small businesses, handle all DNS resolution for connected devices, and often remain in service for a decade or more without security updates — making legacy router vulnerabilities a persistent attack surface.

Overview

CVE-2014-100005 is a cross-site request forgery (CSRF) vulnerability in the D-Link DIR-600 router's web administration interface. The router does not implement CSRF tokens or other request validation mechanisms on its management endpoints. An attacker can craft a malicious web page that, when visited by a user who is authenticated to the router's admin interface (e.g., a user who has logged into the router recently), automatically sends unauthorized requests to the router — changing its DNS configuration, adding port forwarding rules, modifying firewall settings, or changing the admin password.

Affected Versions

No patch is available. The product is end-of-life and must be replaced.

Technical Details

Root Cause: Missing CSRF Tokens in Router Admin Interface

CSRF attacks exploit the browser's automatic inclusion of authentication cookies on all requests to a domain. The D-Link DIR-600's admin interface authenticates via a session cookie stored in the browser after login. The management HTTP endpoints do not validate that incoming requests contain a secret CSRF token known only to the legitimate admin interface — meaning any request with the right URL and parameters is accepted if the session cookie is present.

Attack flow:

1. Router administrator logs into http://192.168.0.1/ and authenticates (browser stores session cookie)
2. Attacker tricks the admin into visiting a malicious web page (via phishing email, malicious ad, or compromised website)
3. The malicious page contains hidden HTML/JavaScript that automatically sends HTTP requests to http://192.168.0.1/
4. The browser automatically attaches the admin session cookie to these requests
5. The router processes the requests as legitimate admin actions — changing DNS, adding port forwarding, changing password, etc.
6. The attacker now controls the router's configuration

Attack Scenarios

Attack Characteristics

Discovery

CSRF vulnerabilities in D-Link DIR-600 were documented by independent security researchers and published on security forums and Exploit-DB in late 2014. The CVE ID format CVE-2014-100005 reflects a non-standard assignment process used for some consumer hardware vulnerabilities.

Exploitation Context

• Persistent exploitation (2024 KEV): Added to CISA KEV in May 2024 — a decade after discovery — confirming that large numbers of DIR-600 routers remain in service and are actively exploited
• Botnet incorporation: Consumer routers with CSRF and command injection vulnerabilities have been systematically incorporated into botnets (Mirai variants and successors) for DDoS-for-hire services
• DNS hijacking campaigns: Threat actors have repeatedly targeted home/SMB routers to hijack DNS, redirect users to credential-harvesting sites, and intercept traffic — CSRF is one of the primary mechanisms used
• No patch available: The DIR-600 is end-of-life with no firmware updates; the only fix is device replacement
• Scale: Large numbers of legacy D-Link routers remain in service globally due to low replacement rates in residential and small business environments

Remediation

1. Replace the router with a currently supported model from any vendor. This is the only complete remediation. D-Link DIR-600 will never receive a security patch.

2. In the interim (if immediate replacement is not possible):

   • Disable web administration over the LAN when not actively needed (most routers allow toggling the admin interface)
   • Never use the router admin interface from a browser that also visits untrusted websites in the same session
   • Use a dedicated device (or separate browser profile) for router administration

3. Check DNS settings after replacement to ensure they have not been changed to attacker-controlled servers. Compare configured DNS against your ISP's expected DNS IPs.

4. Audit port forwarding rules for unauthorized entries — attackers may have added rules exposing internal services before replacement.

5. Change all network passwords (Wi-Fi PSK, other device credentials) after replacement, as DNS hijacking may have exposed credentials over time.