EUVD-2025-18473CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Analysis
Critical stack-based buffer overflow vulnerability in the HTTP POST request handler (function sub_AC78) of D-Link DIR-665 firmware version 1.00, exploitable remotely by authenticated attackers. The vulnerability allows remote code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Public exploit code is available and the affected product line is no longer maintained by D-Link, significantly elevating real-world risk despite requiring low-privilege authentication.
Technical Context
The vulnerability exists in the HTTP POST request handler component of D-Link DIR-665 wireless router firmware, specifically in function sub_AC78. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow condition. The D-Link DIR-665 is a legacy 802.11n wireless router with embedded web management interface. The POST handler fails to properly validate input length before writing to stack-allocated buffers, allowing an authenticated attacker to overflow the stack with arbitrary data. This is a common firmware vulnerability pattern in embedded devices where input validation is insufficient before memory operations.
Affected Products
D-Link DIR-665 firmware version 1.00 is the confirmed affected version. CPE would be: cpe:2.3:o:d-link:dir-665_firmware:1.00:*:*:*:*:*:*:*. The DIR-665 hardware is a legacy 802.11n dual-band wireless router (WLAN device class). No patch versions are available from D-Link as this product reached end-of-life. All DIR-665 devices running firmware 1.00 or potentially earlier versions are vulnerable. D-Link has not released security advisories or patches for this product line due to discontinued support status.
Remediation
PATCH: No official patches exist from D-Link for end-of-life DIR-665 devices. WORKAROUNDS: (1) Immediately discontinue use of DIR-665 devices and replace with supported router hardware from D-Link or alternative vendors, (2) Network isolation - restrict administrative access to the router's web interface to trusted networks only (disable WAN access to port 80/443), (3) Change default credentials if applicable and use strong, unique authentication credentials, (4) Disable HTTP management interface if not required and use HTTPS-only if available, (5) Deploy network-based IDS/IPS rules to detect buffer overflow attempts in HTTP POST requests to legacy D-Link devices. MITIGATION: Organizations should inventory all DIR-665 devices and create an immediate replacement timeline, given the critical nature of the vulnerability and lack of vendor support.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today