CVE-2019-16327

D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side validation, which is bypassable. NOTE: this is an end-of-life product.

• CWE-287

• https://0x62626262.wordpress.com/2019/12/24/dlink-dir-601-router-authentication-bypass-and-csrf/Exploit, Third Party Advisory
• https://0x62626262.wordpress.com/2019/12/24/dlink-dir-601-router-authentication-bypass-and-csrf/Exploit, Third Party Advisory

Published

Dec 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16318In Pimcore before 5.7.1, an attacker with limited privileges…8.8
• CVE-2019-16319In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon…7.5
• CVE-2019-1632A vulnerability in the web-based management interface of Cis…4.6
• CVE-2019-16320Cobham Sea Tel v170 224521 through v194 225444 devices allow…5.3
• CVE-2019-16321ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a req…6.1
• CVE-2019-16326D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-C…8.8
• CVE-2019-16328In RPyC 4.1.x through 4.1.1, a remote attacker can dynamical…7.5
• CVE-2019-16330In NCH Express Accounts Accounting v7.02, persistent cross s…5.4
• CVE-2019-16332In the api-bearer-auth plugin before 20190907 for WordPress,…6.1
• CVE-2019-16333GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (X…5.4
• CVE-2019-16334In Bludit v3.9.2, there is a persistent XSS vulnerability in…4.8
• CVE-2019-16335A Polymorphic Typing issue was discovered in FasterXML jacks…9.8