Which versions of Dir 605L are affected by CVE-2026-5979?

CVE-2026-5979 is a remote code execution vulnerability in D-Link DIR-605L routers (end-of-life product) that allows authenticated attackers to completely compromise router functionality and access…

Is there a public PoC exploit available for CVE-2026-5979?

Yes, a public proof-of-concept exploit is available for CVE-2026-5979. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5979?

Within 24 hours: Identify all DIR-605L 2.13B01 routers in your network inventory and isolate affected devices from critical systems; notify business owners of impacted devices. Within 7 days: Restrict administrative access to these routers to specific administrative IP ranges and disable remote management; implement network segmentation to limit router privileges. Within 30 days: Replace DIR-605L routers with supported, current vendor models; if replacement is unavoidable, implement compensating controls including WAF rules blocking POST requests to /goform/formVirtualServ and strict network access controls.

Dir 605L CVE-2026-5979

Q: What is the CVSS score of CVE-2026-5979?

CVE-2026-5979 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21186 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-09 VulDB

GHSA-8w3p-hgjr-h6h4

Buffer Overflow D-Link Dir 605L D-Link

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 21:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 21:00 euvd

EUVD-2026-21186

Analysis Generated

Apr 09, 2026 - 21:00 vuln.today

CVE Published

Apr 09, 2026 - 20:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution through malicious curTime parameter in formVirtualServ function via POST request to /goform/formVirtualServ endpoint. Affects end-of-life product with no vendor support. Publicly available exploit code exists. Attack requires low-privilege authentication but no user interaction, enabling remote compromise of device confidentiality and integrity.

Technical ContextAI

CWE-120 classic buffer overflow in POST request handler's formVirtualServ function. Improper bounds checking on curTime argument enables memory corruption. CVSS PR:L indicates authenticated context required. Affects cpe:2.3:a:d-link:dir-605l:*:*:*:*:*:*:*:* firmware 2.13B01. Vulnerability exploits insufficient input validation in virtual server configuration interface.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link has discontinued support for DIR-605L per end-of-life status confirmed at https://www.dlink.com/. Primary recommendation: replace device with currently supported hardware. Interim mitigations: disable remote administration interfaces, restrict admin access to trusted internal networks only via firewall rules, disable virtual server configuration feature if operationally feasible. Monitor https://vuldb.com/vuln/356533 for community developments. Organizations using affected devices should prioritize hardware replacement due to absence of security updates and publicly available exploit code.