CVE-2017-9100

login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

8.3 HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C

EPSS

85.45% chance of exploitation in the next 30 days, 100th percentile

Published

2017-05-21

Updated

2024-08-05

Proof-of-concept exploits (3)

• https://www.exploit-db.com/exploits/42039/
• https://www.youtube.com/watch?v=waIJKWCpyNQ
• http://touhidshaikh.com/blog/poc/d-link-dir600-auth-bypass/

References

• CVE Record
• NVD entry

Related

• CVE-2017-9096
• CVE-2017-9101
• CVE-2017-9095
• CVE-2017-9117
• CVE-2017-9085
• CVE-2017-9120