PT-2024-7004 · D Link · D-Link Dir-619L

Yhryhryhr_Miemie

·

Published

2024-09-27

·

Updated

2024-10-12

·

CVE-2024-9570

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DIR-619L B1 version 2.06
Description A critical issue was found in the function formEasySetTimezone of the file /goform/formEasySetTimezone, where the manipulation of the curTime argument leads to a buffer overflow. This can be exploited remotely, potentially allowing an attacker to cause a denial of service by sending a specially crafted POST request. The issue is related to the copying of a buffer without checking the size of the input data when handling the curTime parameter.
Recommendations For D-Link DIR-619L B1 version 2.06, as a temporary workaround, consider disabling the formEasySetTimezone function until a patch is available. Restrict access to the /goform/formEasySetTimezone endpoint to minimize the risk of exploitation. Avoid using the curTime argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-08253
CVE-2024-9570

Affected Products

D-Link Dir-619L