CVE-2025-15194
📋 TL;DR
A stack-based buffer overflow vulnerability in the hedwig.cgi HTTP header handler of D-Link DIR-600 routers allows remote attackers to execute arbitrary code by manipulating the Cookie argument. This affects D-Link DIR-600 routers up to firmware version 2.15WWb02. The vulnerability is particularly dangerous because these products are no longer supported by the vendor.
💻 Affected Systems
- D-Link DIR-600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence, lateral movement, and data exfiltration.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or use the device as part of a botnet.
If Mitigated
Denial of service or limited impact if exploit attempts are blocked by network controls.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. The vulnerability is remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None - product is end-of-life
Restart Required: No
Instructions:
No official patch available. D-Link has ended support for DIR-600 routers. Replace with supported hardware.
🔧 Temporary Workarounds
Disable web interface access
linuxBlock external access to the router's web administration interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Network segmentation
allIsolate affected routers in separate network segments
🧯 If You Can't Patch
- Immediately replace affected D-Link DIR-600 routers with supported hardware
- Implement strict network access controls to limit exposure of affected devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version via router web interface at http://router-ip/ or using command: telnet router-ip (if enabled) and check versionCheck Version:
Check web interface at http://router-ip/ under Status or System InformationVerify Fix Applied:
Verify device replacement or network controls are in place. No patch verification possible.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to hedwig.cgi with long Cookie parameters
- Multiple failed exploit attempts
Network Indicators:
- HTTP POST requests to /hedwig.cgi with abnormal Cookie header length
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
source="router-logs" AND uri="/hedwig.cgi" AND (cookie_length>1000 OR contains(cookie,"AAAAAAAA"))🔗 References
- https://github.com/LonTan0/CVE/blob/main/Stack-Based%20Buffer%20Overflow%20Vulnerability%20in%20hedwig.cgi%20of%20D-Link%20DIR-600.md
- https://github.com/LonTan0/CVE/blob/main/Stack-Based%20Buffer%20Overflow%20Vulnerability%20in%20hedwig.cgi%20of%20D-Link%20DIR-600.md#poc
- https://vuldb.com/?ctiid.338581
- https://vuldb.com/?id.338581
- https://vuldb.com/?submit.724404
- https://www.dlink.com/
