CVE-2024-7357 is an OS command injection flaw in the D-Link DIR-600 router, rated Medium (CVSS 6.3). There is no patch. D-Link says the DIR-600 reached end of life in 2010, and its advice is to retire the device and replace it.
What's affected
The record says the DIR-600 is affected "up to 2.18", in the soapcgi_main function of /soap.cgi, through the service argument. The record is marked as an unsupported product when assigned, and notes that the vendor confirmed early that the product is end of life.
The D-Link support announcement SAP10408 is broader. It lists the DIR-600 in all regions, all hardware revisions and all firmware versions. It gives the end of life and end of service date as 1 December 2010, and the fixed firmware field reads "Not Available". So where the record says "up to 2.18", the vendor treats every firmware version as affected. Use the vendor's wider statement.
How to check if you're exposed
Look for the device first. The model name is printed on the label on the router, and the admin page shows model and firmware. Check branch offices, home offices of remote staff, labs and old storage rooms. A DIR-600 was sold many years ago, so it may be one of the quiet devices on a network nobody owns.
From the network side, look in DHCP leases, ARP tables and any asset list for the D-Link vendor prefix, then confirm the model on the device itself. Also check whether the web administration page is reachable from the internet side or from untrusted segments.
What to do now
- Find every DIR-600 in use and record where it sits.
- Replace it. The vendor recommends that end of life devices be retired and replaced, and no firmware will arrive.
- If replacement must wait, take the admin interface off any untrusted network and do not expose it to the internet.
- D-Link US advises changing the web configuration password often and using Wi-Fi encryption with a unique password for devices still in service. These reduce risk but do not fix the flaw.
- Add the replacement to your asset inventory with a support end date, so the next retirement is planned.
Why it matters
The weakness is CWE-78, OS command injection. A web handler passes a request value into a system command without cleaning it, so a request can make the device run commands it was never meant to run. The record describes the attack as launchable remotely, with low privileges required, and it says an exploit has been disclosed publicly. It does not say the flaw is used in real attacks, and the KEV flag is false.
The deeper lesson is about lifecycle. A flaw in a supported product ends with a patch. A flaw in a product that stopped receiving updates fifteen years ago ends only when someone removes the product. Tracking support status for hardware, as you would for libraries, is what turns that into a routine task. Routers also sit at the network edge, so a weak one is a poor place to save money.
Note that the record includes a public write-up on GitHub, which is where the technical detail lives. This article does not repeat it.
Quick check
Will a firmware update fix CVE-2024-7357?
No. D-Link lists the fixed firmware as not available because the DIR-600 is end of life. Replace the device.
Is it rated Critical?
No. The record scores it 6.3, which is Medium, even though the original report text calls it critical. Use the CVSS score for planning.
Sources
Last reviewed: 19 October 2026.
