CVE-2025-15194
Stack-Based Buffer Overflow in D-Link DIR-600 hedwig.cgi
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| d-link | dir-600 | 2.15wwb02 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the D-Link DIR-600 router up to version 2.15WWb02, specifically in the HTTP Header Handler component's hedwig.cgi file. It involves a stack-based buffer overflow caused by manipulating the Cookie argument. This flaw can be exploited remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to severe impacts including remote code execution, complete compromise of the affected device, denial of service, and loss of confidentiality, integrity, and availability of the system. Since the product is no longer supported, no patches are available, increasing the risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the affected device for unusually long or malformed Cookie headers targeting the hedwig.cgi endpoint. Since the exploit involves sending a crafted HTTP POST request with a maliciously long Cookie value, network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Specific commands are not provided in the resources, but using tools like tcpdump or Wireshark to capture HTTP traffic and grep or similar tools to filter requests to hedwig.cgi with suspicious Cookie headers could help detect exploitation attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected D-Link DIR-600 router with an alternative product, as no known countermeasures or patches exist and the product is no longer supported by the vendor. Additionally, restricting or blocking external access to the router's web interface, especially the hedwig.cgi endpoint, and monitoring for suspicious HTTP requests can help reduce exposure. Network segmentation and applying strict firewall rules to limit access to the device are also recommended. [3]