CVE-2026-129353 is a critical, remotely exploitable stack-based buffer overflow in the login handler of D-Link DIR-600L firmware 2.17 and 2.17b02, and a public exploit is available.
What Is It
The flaw is in the authenticationcgi_main function of authentication.cgi on the D-Link DIR-600L router. If an attacker manipulates the id or password argument, it causes a stack-based buffer overflow. The weakness is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
VulDB, the CNA, published the CVE. NVD lists the record as "Deferred," so NVD has not done its own analysis yet.
Why It Matters
According to the record, the attack can be launched remotely and the exploit "is now public and may be used." The CNA's scores are:
- CVSS 3.1: 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The attack works over the network, has low complexity, and needs no privileges or user interaction. Scope is changed, and confidentiality, integrity and availability impacts are all high. - CVSS 4.0: 9.3 Critical, with exploit maturity marked as Proof-of-Concept.
- CVSS 2.0: 10.0.
The bug is in the authentication handler and needs no privileges, so an attacker who can reach that interface does not need valid credentials first.
KEV status: No CISA KEV entry was supplied for this CVE. The sources do not confirm active exploitation in the wild. A public proof-of-concept is not the same as confirmed exploitation, but it does lower the bar for attackers.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-600L
- Affected versions: 2.17 and 2.17b02
- CPE:
cpe:2.3:h:d-link:dir-600l:*:*:*:*:*:*:*:*
The record does not list any other versions as affected or unaffected.
Patch Status
The supplied NVD data has no fixed firmware version, vendor advisory or patch link. The only vendor reference is D-Link's general homepage. There is no KEV entry, so there is no CISA required action or due date.
If you own an affected DIR-600L, check D-Link directly for firmware updates or end-of-support status. Until a fix is confirmed, treat units on 2.17 or 2.17b02 as exposed.