Read the docs
TI-2013-05137 Aliases CVE-2013-6026GHSA-v2pf-28pq-8p67

The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP…

Priority MEDIUM 53CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.

Why it matters now

EPSS 0.0768 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:h:dlink:di-524up:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:di-604\+:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:di-604s:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:di-604up:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:di-624s:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-100:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:dir-120:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:dlink:tm-g5240:-:*:*:*:*:*:*:*not specified by NVDVulnerableD-Link Japan K.K.
cpe:2.3:h:alphanetworks:vdsl_asl-55052:-:*:*:*:*:*:*:*not specified by NVDVulnerableAlphanetworks
cpe:2.3:h:alphanetworks:vdsl_asl-56552:-:*:*:*:*:*:*:*not specified by NVDVulnerableAlphanetworks
  • cpe:2.3:h:dlink:di-524up:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:di-604\+:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:di-604s:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:di-604up:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:di-624s:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-100:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:dir-120:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:dlink:tm-g5240:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·D-Link Japan K.K.
  • cpe:2.3:h:alphanetworks:vdsl_asl-55052:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Alphanetworks
  • cpe:2.3:h:alphanetworks:vdsl_asl-56552:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Alphanetworks
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:planex:brl-04cw:-:*:*:*:*:*:*:*not specified by NVDVulnerablePLANEX COMMUNICATIONS INC.
cpe:2.3:h:planex:brl-04r:-:*:*:*:*:*:*:*not specified by NVDVulnerablePLANEX COMMUNICATIONS INC.
cpe:2.3:h:planex:brl-04ur:-:*:*:*:*:*:*:*not specified by NVDVulnerablePLANEX COMMUNICATIONS INC.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6026
  2. 2026-10-03 Alias added: GHSA-v2pf-28pq-8p67

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences