CVE-2025-15194
Unknown Unknown - Not Provided
Stack-Based Buffer Overflow in D-Link DIR-600 hedwig.cgi

Publication date: 2025-12-29

Last updated on: 2025-12-29

Assigner: VulDB

Description
A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-29
Last Modified
2025-12-29
Generated
2026-06-16
AI Q&A
2025-12-29
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15194
EUVD
EUVD-2025-205599
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
d-link dir-600 2.15wwb02
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the D-Link DIR-600 router up to version 2.15WWb02, specifically in the HTTP Header Handler component's hedwig.cgi file. It involves a stack-based buffer overflow caused by manipulating the Cookie argument. This flaw can be exploited remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

Impact Analysis

Exploitation of this vulnerability can lead to severe impacts including remote code execution, complete compromise of the affected device, denial of service, and loss of confidentiality, integrity, and availability of the system. Since the product is no longer supported, no patches are available, increasing the risk.

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the affected device for unusually long or malformed Cookie headers targeting the hedwig.cgi endpoint. Since the exploit involves sending a crafted HTTP POST request with a maliciously long Cookie value, network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Specific commands are not provided in the resources, but using tools like tcpdump or Wireshark to capture HTTP traffic and grep or similar tools to filter requests to hedwig.cgi with suspicious Cookie headers could help detect exploitation attempts. [2, 3]

Mitigation Strategies

Immediate mitigation steps include replacing the affected D-Link DIR-600 router with an alternative product, as no known countermeasures or patches exist and the product is no longer supported by the vendor. Additionally, restricting or blocking external access to the router's web interface, especially the hedwig.cgi endpoint, and monitoring for suspicious HTTP requests can help reduce exposure. Network segmentation and applying strict firewall rules to limit access to the device are also recommended. [3]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart