Security readout for executives and security teams
Plain-English summary
D-Link DSM-G600 firmware 1.01 contains a memory-corruption flaw in its file-loading interface. A remote attacker with authenticated access may be able to disrupt the device or compromise its data and operation. Public exploit material increases concern, but confirmed attacks have not been reported in the supplied evidence.
Executive priority
Treat every confirmed version 1.01 device as urgent, prioritizing externally reachable or business-critical systems. Public exploit availability increases near-term risk despite no confirmed active exploitation. Promptly inventory and contain affected devices, then obtain vendor direction or replace unsupported equipment.
Technical view
Manipulated multipart input processed by /load_file.cgi can cause an out-of-bounds write, classified as CWE-119 and CWE-787. The CVSS v2 vector scores it 9.0 with complete confidentiality, integrity, and availability impacts. The vector indicates single authentication is required, although the attack is remotely launchable.
Likely exposure
Only D-Link DSM-G600 version 1.01 is identified as affected. Risk is greatest where the device interface is reachable from untrusted networks or poorly controlled internal segments. The evidence does not establish exposure prevalence, additional affected versions, or other D-Link products.
Exploitation context
Public exploit material is referenced, meaning technical details may be accessible to attackers. However, the CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation. Authentication requirements may reduce exposure but do not eliminate risk from stolen credentials or internal attackers.
Researcher notes
The affected internal function is unspecified. Available evidence identifies an out-of-bounds write and public exploit reference, but provides no vendor reproduction, patch details, expanded version range, or observed attack telemetry. Do not extrapolate impact to versions or products beyond DSM-G600 1.01.
Mitigation direction
- Identify and isolate DSM-G600 devices running version 1.01 from internet and untrusted network access.
- Restrict device access to trusted administrative hosts and enforce strong, unique credentials.
- Check D-Link guidance for supported firmware, patches, mitigations, or end-of-support information.
- Retire or replace affected devices if no vendor-supported correction is available.
Validation and detection
- Inventory device model, hardware revision, firmware version, ownership, and network location.
- Verify whether /load_file.cgi is reachable from internet-facing or lower-trust network segments.
- Review device and network logs for anomalous multipart requests targeting /load_file.cgi.
- Use the cited CTI indicators where access is authorized and their applicability has been confirmed.
- After remediation, recheck firmware, segmentation, access controls, and endpoint reachability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-82680 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810VulDBCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R2.85.9VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R2.85.9VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-397175 | D-Link DSM-G600 Multipart load_file.cgi out-of-bounds writeCVE reference, VulDB · vdb-entry
- VDB-397175 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-82680 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #894188 | D-Link DSM-G600 REVA 1.01 Buffer Overflow / Out-of-bounds Write candidateCVE reference, VulDB · third-party-advisory
- https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-BOF-001-vulndb.mdCVE reference, VulDB · exploit
- https://www.dlink.com/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.