PT-2024-7237 · D Link · D-Link Dir-605L

Wxhwxhwxh_Tutu

·

Published

2024-09-26

·

Updated

2024-10-08

·

CVE-2024-9562

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DIR-605L version 2.13B01 BETA
Description A critical vulnerability was found in the D-Link DIR-605L router, affecting the formSetWizard1 and formSetWizard2 functions. The manipulation of the curTime argument leads to a buffer overflow. This issue can be exploited remotely, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information by sending a specially crafted POST request with the curTime parameter. The exploit has been disclosed to the public and may be used.
Recommendations As a temporary workaround, consider disabling the formSetWizard1 and formSetWizard2 functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Avoid using the curTime parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-08580
CVE-2024-9562

Affected Products

D-Link Dir-605L