PT-2024-7471 · D Link · Dir-605L
Wxhwxhwxh_Mie
·
Published
2024-10-04
·
Updated
2024-10-09
·
CVE-2024-9535
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
D-Link DIR-605L version 2.13B01 BETA
Description:
A critical issue has been identified in the function
formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime can lead to a buffer overflow. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used. The vulnerability is related to the copying of a buffer without checking the size of the input data, which may allow an attacker to execute arbitrary code using the curTime parameter.Recommendations:
As a temporary workaround, consider disabling the
formEasySetupWWConfig function until a patch is available. Restrict access to the /goform/formEasySetupWWConfig endpoint to minimize the risk of exploitation. Avoid using the curTime argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dir-605L