CVE-2019-13101
published 2019-08-08CVE-2019-13101: An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to…
PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
67.09%
99.2th percentile
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dir-600m_firmware | — | — |
| dlink | dir-600m_firmware | — | — |
| dlink | dir-600m_firmware | — | — |
| dlink | dir-600m_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Send an unauthenticated GET request to /wan.htm; a 200 response containing the string 'PPPoE' in the body indicates the device is vulnerable. ↗
- →Confirm the target is a D-Link device by checking /login.htm for the string 'D-Link' in the response body before probing /wan.htm. ↗
- →Nuclei matcher: HTTP 200 status AND body containing '/PPPoE/' on a GET /wan.htm request confirms CVE-2019-13101 vulnerability. ↗
- ·The vulnerability affects D-Link DIR-600M firmware versions 3.01 through 3.06; the Metasploit module was tested on versions 3.01, 3.02, 3.03, 3.04, 3.05, and 3.06. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5cwj-g9vv-pmp6: An issue was discovered on D-Link DIR-600M 3
ghsa_unreviewed·2022-05-24
CVE-2019-13101 [CRITICAL] CWE-306 GHSA-5cwj-g9vv-pmp6: An issue was discovered on D-Link DIR-600M 3
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
GHSA
GHSA-qfjh-hmr6-hvpc: D-Link DIR-600M C1 3
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2019-7736 [CRITICAL] CWE-425 GHSA-qfjh-hmr6-hvpc: D-Link DIR-600M C1 3
D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.
VulnCheck
D-Link dir-600m_firmware Missing Authentication for Critical Function
vulncheck·2019·CVSS 9.8
CVE-2019-13101 [CRITICAL] D-Link dir-600m_firmware Missing Authentication for Critical Function
D-Link dir-600m_firmware Missing Authentication for Critical Function
An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
Affected: D-Link dir-600m_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-19&host_type=src&vulnerability=cve-2019-13101; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-21&host_type=src
No detection rules found.
Exploit-DB
D-Link DIR-600M - Authentication Bypass (Metasploit)
exploitdb·2019-08-14·CVSS 9.8
CVE-2019-13101 [CRITICAL] D-Link DIR-600M - Authentication Bypass (Metasploit)
D-Link DIR-600M - Authentication Bypass (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control',
'Description' => %q{
This module attempts to find D-Link router DIR-600M which is
vulnerable to Incorrect Access Control. The vulnerability exists in
wan.htm, which is accessible without authentication. This
vulnerabilty can lead an attacker to manipulate WAN settings.
This module has been tested successfully on Firmware Version
3.01,3.02,3.03,3.04,3.05,3.06.
},
'Author' => [ 'Devendra Singh Solanki ' ],
'License' => MSF_LICENSE,
'References' =>
[
'CVE', '2019-13101'
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Au
Nuclei
D-Link DIR-600M - Authentication Bypass
nuclei·CVSS 9.8
CVE-2019-13101 [CRITICAL] D-Link DIR-600M - Authentication Bypass
D-Link DIR-600M - Authentication Bypass
D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.
Template:
id: CVE-2019-13101
info:
name: D-Link DIR-600M - Authentication Bypass
author: Suman_Kar
severity: critical
description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.
impact: |
An attacker can bypass authentication and gain unauthorized access to the router's settings, potentially leading to further compromise of the netwo
No writeups or analysis indexed.
http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlhttp://seclists.org/fulldisclosure/2019/Aug/5https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101https://seclists.org/bugtraq/2019/Aug/17https://us.dlink.com/en/security-advisoryhttps://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdfhttp://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.htmlhttp://seclists.org/fulldisclosure/2019/Aug/5https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101https://seclists.org/bugtraq/2019/Aug/17https://us.dlink.com/en/security-advisoryhttps://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf
2019-08-08
Published
Exploited in the wild