What is the CVSS score of CVE-2026-5984?

CVE-2026-5984 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-5984?

Within 24 hours: Inventory all D-Link DIR-605L devices in production and segment them to restricted network zones; document any business justification for continued use. Within 7 days: Implement network-based access controls limiting authenticated administrative access to the device management interfaces and restrict POST requests to /goform/formSetLog; test controls do not disrupt legitimate operations. Within 30 days: Develop and execute a decommissioning plan to replace DIR-605L units with supported, patched router models; prioritize devices with internet-facing management interfaces.

D-Link CVE-2026-5984

EUVD-2026-21223 HIGH

Buffer Overflow (CWE-119)

2026-04-09 cna@vuldb.com

GHSA-vrqw-grr3-6x6h

Buffer Overflow D-Link

7.4

CVSS 4.0 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to D-Link DIR-605L interface
Delivery

Send POST request to /goform/formSetLog
Exploit

Inject oversized curTime parameter
Execution

Trigger buffer overflow in formSetLog function
Impact

Execute arbitrary code with device privileges

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires authenticated access to D-Link DIR-605L firmware version 2.13B01 (end-of-life product). Attacker must send crafted POST request to /goform/formSetLog with malicious curTime parameter. No user interaction needed. CVSS indicates low-privilege authentication required.
Impact	CVSS 7.4 reflects high impact (confidentiality, integrity) via unauthenticated network access to legacy, unsupported hardware. Moderate exploitation activity observed. Primary risk: attackers targeting organizations unable to patch DIR-605L devices. Legacy product status limits blast radius but enables opportunistic compromise of persistent deployments.
Exploit ScenarioDerived	Authenticated attacker sends POST request to /goform/formSetLog with oversized curTime parameter, triggering buffer overflow in formSetLog function. Publicly available exploit code exists; remote network access requires valid credentials (PR:L).

Monitor Track and reassess. Why: Vendor states no customer action required.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Buffer overflow in D-Link DIR-605L 2.13B01 router allows authenticated remote attackers to achieve code execution via POST request manipulation. The formSetLog function in /goform/formSetLog improperly handles the curTime parameter, enabling memory corruption. Publicly available exploit code exists. This end-of-life product receives no vendor support or security updates.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link has formally discontinued DIR-605L with no security support (https://www.dlink.com/). Primary mitigation: immediately retire and replace affected hardware with currently supported router model from active product line. Interim risk reduction: disable remote administration interfaces, restrict administrative access to trusted internal IP addresses only, implement network segmentation to isolate device, monitor for anomalous POST requests to /goform/formSetLog. Organizations must prioritize hardware replacement due to end-of-life status and publicly available exploit code.

Affected VersionsENISA

DIR-605L 2.13B01

Affected Packages

euvd dir_605l no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-119 buffer overflow in formSetLog function within POST Request Handler. Attack vector exploits insufficient input validation on curTime parameter during POST processing. CVSS 4.0 vector indicates network-accessible, low-complexity attack requiring low-privileged authentication (PR:L), yielding high confidentiality/integrity/availability impact on vulnerable component.

Know when D-Link gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was identified in D-Link DIR-605L 2.13B01. Impacted is the function formSetLog of the file /goform/formSetLog of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

A buffer overflow vulnerability in D-Link DIR-605L routers (firmware 2.13B01) allows authenticated users to execute arbitrary code through malformed POST requests, creating a critical insider threat risk for organizations still operating this end-of-life device. Since the product no longer receives vendor support and no patch is available, affected networks face persistent code execution risk from any authenticated user, including compromised internal accounts.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to device management interfaces via firewall rules allowing only trusted administrative subnets; (2) Disable remote management features and enforce local-only access; (3) Implement strict access controls limiting which users can authenticate to the device; (4) Monitor POST requests to /goform/formSetLog for anomalous parameters; (5) Prioritize replacement with current-generation, vendor-supported equipment as primary mitigation strategy.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

Vendor states no customer action required

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +37

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.