EUVD-2026-21187
GHSA-vp9w-9m49-6hgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link DIR-605L web interface
-
DeliverySend POST request to /goform/formSetMACFilter
-
ExploitInject oversized value in curTime parameter
-
ExecutionTrigger buffer overflow in formSetMACFilter function
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to D-Link DIR-605L firmware version 2.13B01 running unsupported firmware. Attacker must send crafted POST request to /goform/formSetMACFilter with malicious curTime parameter. Only affects end-of-life devices no longer receiving security updates. |
| Impact | CVSS 7.4 reflects high confidentiality and integrity impact via unauthenticated network access to an end-of-life router. Buffer overflow in MAC filter endpoint poses significant risk to legacy device deployments. Blast radius limited by product obsolescence and authentication requirement mitigating broader internet exposure. |
| Exploit ScenarioDerived | Authenticated attacker sends POST request to /goform/formSetMACFilter with oversized curTime parameter, triggering stack buffer overflow. Published exploit code enables arbitrary code execution on vulnerable DIR-605L 2.13B01 instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated attackers to achieve remote code execution via crafted curTime parameter in formSetMACFilter POST handler. This end-of-life product receives no vendor support. Publicly available exploit code exists. Attackers with low-privilege network access can compromise device confidentiality and integrity remotely without user interaction.
RemediationAI
No vendor-released patch identified at time of analysis - D-Link discontinued support for DIR-605L hardware. Immediate replacement with currently supported router model strongly recommended. Interim risk reduction: disable remote administration interfaces, restrict administrative access to trusted IP ranges via firewall rules, enforce strong authentication credentials, implement network segmentation isolating device from critical assets. Monitor https://www.dlink.com/ for any unexpected security bulletins. Migration to supported hardware is the only sustainable remediation for end-of-life network infrastructure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 buffer overflow in formSetMACFilter function at /goform/formSetMACFilter endpoint. curTime parameter lacks bounds checking, enabling memory corruption. CVSS vector PR:L indicates authenticated exploitation required. Affects discontinued D-Link DIR-605L firmware 2.13B01 exclusively.
Know when D-Link gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
CVE-2026-5980 is a buffer overflow vulnerability in the end-of-life D-Link DIR-605L router (firmware 2.13B01) that allows authenticated network attackers to execute arbitrary code remotely. Since the vendor provides no patches and the product is unsupported, affected organizations face persistent remote code execution risk with no vendor remediation path, requiring immediate device replacement or decommissioning.
No vendor patch available for this end-of-life product. Interim mitigations: (1) Disable remote access and SSH/telnet management interfaces; (2) Restrict network access to the device via upstream firewall-limit inbound connections to trusted administrative subnets only; (3) Monitor for suspicious POST requests to /formSetMACFilter endpoints; (4) Segment the router on an isolated management VLAN. These controls reduce but do not eliminate risk; device replacement is the only permanent remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClien
The D-Link DIR-645 Wired/Wireless Router Rev. Rated high severity (CVSS 8.8), this vulnerability is no authentication re
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set
Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. Rated critical severity (
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Rated high severity (CVSS 8.0)
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated use
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?RE
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. Rated medium severity (CVSS 4.3), thi
Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remot
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an
Exploit-DB