How severe is CVE-2025-15194?

CVE-2025-15194 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-15194 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-15194?

CVE-2025-15194 affects Dlink Dir-600 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-15194?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-15194 have an EU (EUVD) identifier?

Yes. CVE-2025-15194 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-205599.

When was CVE-2025-15194 published?

CVE-2025-15194 was published on 2025-12-29 and last updated on 2026-06-17.

CVE-2025-15194

CVE-2025-15194 is a critical-severity vulnerability in Dlink Dir-600 Firmware with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
CVSS v4: 8.9
EPSS exploit prediction: 1% (60th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-205599
Weakness: CWE-119
Affected product: Dlink Dir-600 Firmware
Published: 2025-12-29
Last modified: 2026-06-17

Description

A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Frequently asked questions

What is CVE-2025-15194?: A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
How severe is CVE-2025-15194?: CVE-2025-15194 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-15194 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-15194?: CVE-2025-15194 affects Dlink Dir-600 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-15194?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-15194 have an EU (EUVD) identifier?: Yes. CVE-2025-15194 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-205599.
When was CVE-2025-15194 published?: CVE-2025-15194 was published on 2025-12-29 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:dlink:dir-600_firmware:2.15ww:*:*:*:*:*:*:*

More vulnerabilities in Dlink Dir-600 Firmware

CVE-2018-25115 — Critical (CVSS 9.8): Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815…
CVE-2013-10069 — Critical (CVSS 9.8): The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13),…
CVE-2013-10048 — Critical (CVSS 9.8): An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600…
CVE-2023-33626 — Critical (CVSS 9.8): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi…
CVE-2023-33625 — Critical (CVSS 9.8): D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability…
CVE-2013-7471 — Critical (CVSS 9.8): An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01,…

All CVEs affecting Dlink Dir-600 Firmware →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →