PT-2025-31530 · D Link · Dir-605L

Published 2012-10-08 · Updated 2025-07-31 · CVE-2012-10021

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-605L versions 1.12 through 1.13

Description A stack-based buffer overflow exists in the getAuthCode() function when processing CAPTCHA data. Exploitation may allow a remote attacker to execute arbitrary code with root privileges. The issue is due to the unsafe use of sprintf() when processing user-supplied data via the FILECODE parameter.

Recommendations D-Link DIR-605L version 1.12: At the moment, there is no information about a newer version that contains a fix for this vulnerability. D-Link DIR-605L version 1.13: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2025-09435

CVE-2012-10021

Affected Products

Dir-605L

References · 7

• 🔥 https://exploit-db.com/exploits/29127 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb · Exploit
• 🔥 https://web.archive.org/web/20121012062554/http://devttys0.com/2012/10/exploiting-a-mips-stack-overflow · Exploit
• https://bdu.fstec.ru/vul/2025-09435 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-10021 · Security Note
• https://vulncheck.com/advisories/dlink-dir605l-captcha-handling-stack-based-buffer-overflow · Note
• https://forums.dlink.com/index.php?topic=51923.0 · Note