Is CVE-2014-100005 being actively exploited?

Yes. CVE-2014-100005 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 16, 2024.

What is the CVSS score for CVE-2014-100005?

CVE-2014-100005 has a CVSS 3.1 base score of 8.0 (HIGH).

CVE-2014-100005

HIGH · CVSS 8.0CISA KEV: actively exploitedEPSS 43.5%EU EUVD: exploited

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.

Key facts

CVSS score: 8.0 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-352
EPSS score: 43.5% (99th percentile)
In CISA KEV: Yes, added May 16, 2024
In EU EUVD: Yes (EUVD-2014-1036)
Published: January 13, 2015
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability

Added to the KEV catalog on May 16, 2024; federal remediation due June 6, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2014-1036 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

dlink / dir-600
dlink / dir-600 firmware

References

http://resources.infosecinstitute.com/csrf-unauthorized-remote-admin-access/(Exploit, Third Party Advisory)
http://secunia.com/advisories/57304(Broken Link)
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10018(Patch, Vendor Advisory)
https://exchange.xforce.ibmcloud.com/vulnerabilities/91794(Third Party Advisory, VDB Entry)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-100005(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain