How to Fix CVE-2014-100005: Cross-Site Request Forgery (CSRF) in Dir-600 Firmware

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2024-05-16, federal due date 2024-06-06.

What is CVE-2014-100005?

CVE-2014-100005 is a set of cross-site request forgery (CSRF) flaws in the D-Link DIR-600 wireless router, hardware revision Bx, running firmware older than 2.17b02. CSRF (CWE-352) means the router's web administration interface accepts state-changing requests without verifying that the request actually originated from the admin's own session. There is no anti-CSRF token and no origin check on the configuration endpoints. So if an authenticated administrator is logged in to the router and then visits a malicious or booby-trapped web page in another browser tab, that page can silently fire requests at the router using the admin's existing session.

The original disclosure documented four distinct forgeable actions, each hitting a specific DIR-600 endpoint:

• Create a rogue administrator account via a crafted configuration module posted to hedwig.cgi.
• Enable remote management (turn on WAN-side admin access) through the same hedwig.cgi configuration path.
• Apply the malicious settings with a SETCFG,SAVE,ACTIVATE action sent to pigwidgeon.cgi, which commits and activates the new configuration.
• Trigger a ping through a ping action against diagnostic.php, usable for reconnaissance or to confirm the forged request landed.

Chained together, these give a remote attacker a path to a permanent backdoor account and WAN-exposed administration on the router without ever knowing the admin password. This is an authentication-hijack and privilege-escalation problem against the device, not remote code execution in the classic memory-corruption sense and not a denial-of-service bug.

Why this CVE matters

CISA added CVE-2014-100005 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-05-16, a decade after disclosure, because attackers are still actively abusing DIR-600 units that were never patched or retired. The CVSS 3.1 base score is 8.0 (High), vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Confidentiality, integrity, and availability impacts are all High, and CISA's SSVC assessment rates technical impact as “total” with exploitation “active.”

The practical risk is that a compromised home or small-office router becomes attacker infrastructure: DNS can be repointed to steal credentials, traffic can be intercepted, and the box can be enrolled in a botnet. Because the forged requests ride the admin's authenticated session, no brute force or password guessing is needed. If your DIR-600 (rev. Bx) is internet-reachable and running firmware older than 2.17b02, assume it is a target.

Identify whether you are affected

This affects the D-Link DIR-600 consumer/SOHO router, hardware revision Bx specifically. You check the firmware from the router itself, not from a server package manager. There is nothing to query with dpkg, rpm, or winget here.

1. Log in to the router's web admin, typically at http://192.168.0.1.
2. Open Maintenance → System (or the Status → Device Info page). Note the Hardware Version and Firmware Version.
3. If the hardware version starts with Bx (for example B1, B2) and the firmware version is older than 2.17b02, this CVE applies to you and you must upgrade.

The DIR-600 reached end of life years ago. If your unit is not hardware revision Bx, or D-Link no longer offers a firmware for your region/revision that reaches 2.17b02 or later, the correct fix is to replace the router with a currently supported model. An unsupported, internet-facing router that cannot be patched should be retired.

How to fix CVE-2014-100005

The fix is to flash DIR-600 firmware 2.17b02 (rev. Bx) or later, which D-Link shipped to add CSRF protection to the affected endpoints. This is a firmware image upgrade applied through the router's own web interface, there are no operating-system package commands involved.

Flash the patched firmware

1. Download firmware 2.17b02 (or the latest available for your region and the Bx revision) from D-Link's official support/download site. Match the file to your exact hardware revision; flashing the wrong revision can brick the unit.
2. Connect a computer to the router by Ethernet cable. Do not flash firmware over Wi-Fi.
3. Log in to the admin interface at http://192.168.0.1.
4. Go to Maintenance → Firmware Upgrade (sometimes Tools → Firmware), select the downloaded image, and start the upgrade.
5. Wait for the router to finish writing and reboot. Do not power-cycle or disconnect during the flash.

Harden the router after flashing

Because this CVE can plant a rogue admin account and silently enable WAN management, treat any previously exposed unit as potentially tampered with and reset its trust state:

1. After the upgrade, perform a factory reset and reconfigure from scratch rather than restoring an old config backup that could carry attacker changes.
2. Set a strong, unique admin password.
3. Under remote/WAN management settings, confirm remote administration is disabled so the admin interface is not reachable from the internet.
4. Review the user/admin account list and delete any account you did not create.
5. Reset DNS settings to your ISP or a trusted resolver in case they were repointed.

If you can't patch immediately

Flashing 2.17b02 is the only durable fix. Until you can, reduce the attack surface: these steps lower the odds the forged requests ever reach the router, but they do not remove the vulnerability:

• Disable remote/WAN management in the router settings so the admin interface is reachable only from the LAN. CSRF still works from inside the LAN, but you remove the internet-facing path.
• Log out of the router admin when you finish configuring it, and avoid browsing other sites in the same browser session while logged in. The CSRF only fires while an admin session is live.
• Use a dedicated browser or private window for router administration, then close it, so no malicious tab can ride the session.
• Change the LAN IP / admin port away from the default 192.168.0.1 to make the endpoint harder to target blindly, and change the default admin password.

Verify the fix landed

Confirm remediation from the router itself:

1. Log back in to the admin interface and check Maintenance → System (or Status), the firmware version must read 2.17b02 or later.
2. Confirm remote management is off and the account list contains only the administrators you created.
3. From an external network, verify the router's admin port is not reachable on the WAN address.

If the unit is internet-facing and was unpatched during the exposure window, assume it may have been touched: factory-reset it, rebuild the configuration by hand, rotate any Wi-Fi and admin passwords, and watch downstream clients for signs of DNS hijacking.

Frequently asked questions

Which firmware version fixes CVE-2014-100005?

D-Link DIR-600 firmware 2.17b02 for hardware revision Bx. Any firmware older than 2.17b02 on a Bx unit is vulnerable. Flash 2.17b02 or later through the router's Maintenance → Firmware Upgrade page, then confirm the version string on the status page.

My DIR-600 is end-of-life and there is no firmware for my revision. What should I do?

Replace the router. The DIR-600 is a discontinued consumer model. If D-Link does not offer a firmware that reaches 2.17b02 or later for your hardware revision and region, an unsupported internet-facing router cannot be made safe. retire it for a currently supported model.

Can I just block this with a firewall instead of patching?

Not fully. Disabling remote/WAN management removes the internet-facing path, but CSRF still fires from any device on the LAN while an admin session is open. The firmware update is the only durable fix because it adds the missing anti-CSRF protection to hedwig.cgi, pigwidgeon.cgi, and diagnostic.php.

How do I know if my router was already compromised through this CSRF?

Log in and review the administrator account list for accounts you did not create, check whether remote management was silently enabled, and inspect the DNS settings for unexpected resolver addresses. If anything looks off, factory-reset the router, rebuild the config by hand, and rotate all admin and Wi-Fi passwords.

References

• Official vendor advisory: http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2014-100005
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005
• Additional reference: http://secunia.com/advisories/57304
• Additional reference: https://exchange.xforce.ibmcloud.com/vulnerabilities/91794
• Additional reference: http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other CVEs touching related code paths, worth patching together with this one:

• How to Fix CVE-2014-6287: Code Injection in Rejetto HTTP File Server (HFS)
• How to Fix CVE-2014-7169: OS command injection in Bash
• How to Fix CVE-2014-6278: Remote Code Execution in GNU Bash
• How to Fix CVE-2014-3120: Improper Access Control in Elastic Elasticsearch
• How to Fix CVE-2014-3931: Memory Corruption in Multi-Router Looking Glass (MRLG)