What is the CVSS score of CVE-2026-5979?

CVE-2026-5979 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-5979?

Yes, a public proof-of-concept exploit is available for CVE-2026-5979. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5979?

Within 24 hours: Identify all DIR-605L 2.13B01 routers in your network inventory and isolate affected devices from critical systems; notify business owners of impacted devices. Within 7 days: Restrict administrative access to these routers to specific administrative IP ranges and disable remote management; implement network segmentation to limit router privileges. Within 30 days: Replace DIR-605L routers with supported, current vendor models; if replacement is unavoidable, implement compensating controls including WAF rules blocking POST requests to /goform/formVirtualServ and strict network access controls.

Dir 605L CVE-2026-5979

EUVD-2026-21186 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-09 VulDB

GHSA-8w3p-hgjr-h6h4

Buffer Overflow D-Link Dir 605L D-Link

7.4

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to D-Link DIR-605L web interface
Delivery

Send POST request to /goform/formVirtualServ
Exploit

Inject oversized curTime parameter
Execution

Overflow buffer in formVirtualServ function
Impact

Execute arbitrary code on router

Vulnerability Assessment

Weakness	CWE CWE-120 ASVS 5.0 V15 - Secure Coding and Architecture Buffer copy size validation MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	D-Link DIR-605L router running firmware version 2.13B01 or earlier. Attacker requires authenticated access (low-privilege user login) to send malicious POST requests to /goform/formVirtualServ endpoint with crafted curTime parameter causing buffer overflow. No victim interaction needed.
Impact	CVSS 7.4 with high confidentiality and integrity impact. Authenticated remote buffer overflow in end-of-life D-Link router. Moderate observed exploitation activity. Real risk depends on deployment prevalence; legacy device status limits blast radius but creates persistent vulnerability in installed base.
Exploit ScenarioDerived	Authenticated attacker sends POST request to /goform/formVirtualServ with oversized curTime parameter, triggering buffer overflow in formVirtualServ function. Publicly available exploit code exists enabling remote code execution on unpatched devices.

Monitor Track and reassess. Why: Vendor states no customer action required.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution through malicious curTime parameter in formVirtualServ function via POST request to /goform/formVirtualServ endpoint. Affects end-of-life product with no vendor support. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling remote compromise of device confidentiality and integrity.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link has discontinued support for DIR-605L per end-of-life status confirmed at https://www.dlink.com/. Primary recommendation: replace device with currently supported hardware. Interim mitigations: disable remote administration interfaces, restrict admin access to trusted internal networks only via firewall rules, disable virtual server configuration feature if operationally feasible. Monitor https://vuldb.com/vuln/356533 for community developments. Organizations using affected devices should prioritize hardware replacement due to absence of security updates and publicly available exploit code.

Affected VersionsENISA

DIR-605L 2.13B01

Affected Packages

euvd dir_605l no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-120 classic buffer overflow in POST request handler's formVirtualServ function. Improper bounds checking on curTime argument enables memory corruption. CVSS PR:L indicates authenticated context required. Affects cpe:2.3:a:d-link:dir-605l:*:*:*:*:*:*:*:* firmware 2.13B01. Vulnerability exploits insufficient input validation in virtual server configuration interface.

Know when Dir 605L gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 21:16 vuln.today

Public exploit code

CVE Published

Apr 09, 2026 - 20:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

CVE-2026-5979 is a remote code execution vulnerability in D-Link DIR-605L routers (end-of-life product) that allows authenticated attackers to completely compromise router functionality and access network traffic. This affects organizations still operating legacy DIR-605L devices, exposing internal networks to unauthorized access and data interception with no vendor remediation available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable remote management and restrict administrative access to trusted internal IP ranges only; (2) Implement network segmentation to minimize router access privileges; (3) Deploy Web Application Firewall or equivalent to block POST requests to /goform/formVirtualServ endpoint; (4) Monitor router logs for suspicious curTime parameters and POST activity; (5) Prioritize replacement with vendor-supported equipment-device is end-of-life with no security support pathway. Device retirement is the recommended control.

Threat Intelligence Overview

EPSS Score

0.0%

Top 86% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

Vendor states no customer action required

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +37

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.