{"id":"CVE-2013-6026","aliases":["EUVD-2013-5856","GHSA-v2pf-28pq-8p67"],"status":"published","title":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and...","description":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0768,"percentile":0.94633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-10-19T10:00:00Z","modified":"2026-06-16T23:59:54Z","products":[{"vendor":"alphanetworks","product":"vdsl_asl-55052"},{"vendor":"alphanetworks","product":"vdsl_asl-56552"},{"vendor":"dlink","product":"di-524up"},{"vendor":"dlink","product":"di-604\\+"},{"vendor":"dlink","product":"di-604s"},{"vendor":"dlink","product":"di-604up"},{"vendor":"dlink","product":"di-624s"},{"vendor":"dlink","product":"dir-100"},{"vendor":"dlink","product":"dir-120"},{"vendor":"dlink","product":"tm-g5240"},{"vendor":"planex","product":"brl-04cw"},{"vendor":"planex","product":"brl-04r"},{"vendor":"planex","product":"brl-04ur"}],"references":[{"url":"http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.dlink.com/uk/en/support/security","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/248083","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6026"},{"url":"http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor"},{"url":"https://github.com/advisories/GHSA-v2pf-28pq-8p67"}],"sources":{"cve":[{"id":"CVE-2013-6026","description":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.","status":"published","published":"2013-10-19T10:00:00Z","modified":"2024-09-16T23:50:32.878Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-5856","description":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.","status":"published","published":"2013-10-19T10:00:00Z","modified":"2024-09-16T23:50:32Z","updated_at":"2026-11-03T00:29:04.923307Z"}],"ghsa":[{"id":"GHSA-v2pf-28pq-8p67","title":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and...","description":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.","status":"published","published":"2022-05-17T05:00:10Z","modified":"2025-04-11T04:16:21Z","updated_at":"2026-11-02T15:01:14.923786Z"}],"nvd":[{"id":"CVE-2013-6026","description":"The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.","status":"published","published":"2013-10-19T10:36:08.963Z","modified":"2026-06-16T23:59:54.77Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:40.988689Z"}]}}