CVE-2016-10405

CRITICAL

Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.

Published: Sep 7, 2017 Modified: Jun 17, 2026

CWE-384

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
d-link	dir-600l_firmware	*

GitHub Security Advisory GHSA-r7fx-8g9m-3539

Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17...

References (2)

ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600L/DIR-600L_REVA_FIRMWARE_PATCH_NOTES_1.17.B01_EN_WW.PDF Vendor Advisory
ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600L/DIR-600L_REVA_FIRMWARE_PATCH_NOTES_1.17.B01_EN_WW.PDF Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 1.93%

Top 22% most likely to be exploited

Threat Score 39.8 / 100

Data Sources

NVD EPSS GitHub