Field brief
Critical stack‑based overflow in D‑Link DIR‑600L authentication.cgi
A newly discovered CVE‑2026‑129353 exposes a critical buffer overflow in the DIR‑600L router’s authentication.cgi, affecting firmware 2.17/2.17b02 with a CVSS score of 10.0 and no vendor advisory or KEV listing yet.
A critical stack‑based overflow has been identified in the D‑Link DIR‑600L router’s `authentication.cgi` (CVE‑2026‑129353). The vulnerability affects firmware versions 2.17 and 2.17b02 and carries a CVSS score of 10.0, indicating a high potential for remote exploitation. The National Vulnerability Database lists the CVE with a 10.0 score but notes that it is not yet in the CISA KEV catalog and no vendor advisory has been issued. As of the 14‑15 Nov 2026 window, no public exploitation has been reported. D‑Link users should verify their firmware version and plan to apply a patch once the vendor releases one. Until then, monitor for a vendor advisory and keep the router’s firmware up to date to mitigate this high‑severity risk. See the full NVD entry here: CVE‑2026‑129353.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.