Which versions of D-Link are affected by CVE-2026-5982?

CVE-2026-5982 affects D-Link DIR-605L wireless routers (firmware 2.13B01), allowing authenticated attackers to execute arbitrary code through a buffer overflow vulnerability.

Is there a public PoC exploit available for CVE-2026-5982?

Yes, a public proof-of-concept exploit is available for CVE-2026-5982. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5982?

Within 24 hours: Identify all D-Link DIR-605L devices running firmware 2.13B01 in your environment and document their network locations and administrative access controls. Within 7 days: Isolate affected devices to restricted network segments with egress filtering, restrict administrative access to authorized personnel only, and implement network-based detection rules for POST requests to /goform/formAdvNetwork. Within 30 days: Initiate replacement procurement for DIR-605L units with current vendor-supported models; prioritize devices in critical infrastructure or high-security zones.

D-Link CVE-2026-5982

Q: What is the CVSS score of CVE-2026-5982?

CVE-2026-5982 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21191 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-09 VulDB

GHSA-hj65-rw2v-r6pj

D-Link Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 22:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21191

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

CVE Published

Apr 09, 2026 - 21:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects the function formAdvNetwork of the file /goform/formAdvNetwork of the component POST Request Handler. Performing a manipulation of the argument curTime results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Buffer overflow in D-Link DIR-605L 2.13B01 wireless router enables remote authenticated attackers to achieve arbitrary code execution via crafted POST requests to /goform/formAdvNetwork endpoint. Exploitation manipulates the curTime parameter in the formAdvNetwork function, triggering memory corruption. This end-of-life device receives no vendor support; publicly available exploit code exists. Affected hardware presents elevated risk in legacy network environments where administrative credentials may be compromised.

Technical ContextAI

CWE-120 stack-based buffer overflow occurs in formAdvNetwork POST handler when processing curTime parameter without bounds validation. CVSS:4.0 vector (AV:N/PR:L) confirms network-accessible attack requiring low-privilege authentication. Exploitation achieves high confidentiality/integrity/availability impact through memory corruption leading to arbitrary code execution on embedded firmware.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link discontinued support for DIR-605L hardware; manufacturer provides no firmware updates per https://www.dlink.com/. Immediate replacement with actively supported router models is required for production environments. Interim risk reduction: disable remote administration interfaces, restrict administrative access to trusted internal networks only via firewall rules, enforce strong unique administrative credentials, implement network segmentation to isolate legacy devices. Organizations retaining this hardware accept full residual risk from unpatched memory corruption vulnerability with public exploit availability. Technical analysis: https://vuldb.com/vuln/356536