Is CVE-2013-6026 being actively exploited?

CVE-2013-6026 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-6026?

CVE-2013-6026 has a CVSS 2.0 base score of 10.0 (HIGH).

CVE-2013-6026

HIGH · CVSS 10.0EPSS 7.7%EU EUVD

The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.

Key facts

CVSS score: 10.0 (v2.0)
Severity: HIGH
CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness (CWE): CWE-264
EPSS score: 7.7% (95th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2013-5856)
Published: October 19, 2013
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-5856 in the EU Vulnerability Database. Last updated in EUVD on September 16, 2024.

View on the EU Vulnerability Database

Affected products

alphanetworks / vdsl asl-55052
alphanetworks / vdsl asl-56552
dlink / di-524up
dlink / di-604+
dlink / di-604s
dlink / di-604up
dlink / di-624s
dlink / dir-100
dlink / dir-120
dlink / tm-g5240
planex / brl-04cw
planex / brl-04r
planex / brl-04ur

References

http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/(Exploit)
http://www.dlink.com/uk/en/support/security
http://www.kb.cert.org/vuls/id/248083(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain