CVE-2025-15194
Published: 29 December 2025
Description
A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It…
more
is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Mitigating Controls (NIST 800-53 r5)AI
Prohibits the use of unsupported system components like the end-of-life D-Link DIR-600 router, which lacks patches for this unremediable buffer overflow vulnerability.
Requires timely identification, reporting, and remediation of known flaws such as CVE-2025-15194, mandating isolation or replacement of unpatchable EOL devices.
Monitors and controls network communications at boundaries to block remote exploitation of the unauthenticated HTTP Cookie manipulation vulnerability on internet-facing routers.
Security SummaryAI
CVE-2025-15194 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting D-Link DIR-600 routers up to firmware version 2.15WWb02. The flaw resides in an unknown functionality of the hedwig.cgi file within the HTTP Header Handler component, triggered by manipulation of the Cookie argument.
The vulnerability enables remote exploitation over the network with low complexity, requiring no privileges, authentication, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8). Attackers can send crafted HTTP requests to overflow the stack, potentially achieving arbitrary code execution and full compromise of the device, including high impacts on confidentiality, integrity, and availability.
Affected products are no longer supported by the maintainer, with no patches available. Advisories highlight a publicly disclosed exploit, including proof-of-concept code, urging isolation or replacement of exposed devices. Key references include GitHub repositories detailing the vulnerability and POC, as well as VulDB entries (ctiid.338581, id.338581).
The public availability of the exploit elevates risks for internet-facing DIR-600 routers, particularly in environments with legacy hardware.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in HTTP CGI endpoint (hedwig.cgi) on internet-facing router enables unauthenticated remote code execution via crafted network requests, directly facilitating T1190: Exploit Public-Facing Application.