What is the CVSS score of EUVD-2026-21222?

EUVD-2026-21222 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-21222?

Within 24 hours: Inventory all D-Link DIR-605L routers in production and flag as critical risk. Within 7 days: Isolate affected devices to a segregated management network or plan immediate replacement with current-generation equipment; if isolation is infeasible, disable remote management features and restrict network access via firewall rules. Within 30 days: Complete replacement of all DIR-605L units with vendor-supported alternatives; document remediation status for compliance audits.

Dir 605l Firmware EUVD-2026-21222

| CVE-2026-5983 HIGH

Buffer Overflow (CWE-119)

2026-04-09 cna@vuldb.com

GHSA-3vj3-fr37-rf37

Buffer Overflow D-Link Dir 605l Firmware

7.4

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to D-Link DIR-605L web interface
Delivery

Send POST request to /goform/formSetDDNS
Exploit

Inject oversized curTime parameter value
Execution

Trigger buffer overflow in formSetDDNS function
Impact

Execute arbitrary code on router

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authenticated access required to D-Link DIR-605L firmware version 2.13B01 (end-of-life product). Attacker must POST a crafted request to /goform/formSetDDNS with malicious curTime parameter to trigger buffer overflow in formSetDDNS function.
Impact	CVSS 7.4 reflects high confidentiality/integrity impact via authenticated remote buffer overflow. Legacy D-Link DIR-605L (EOL, unmaintained) amplifies risk; no patches available. Moderate observed exploitation activity. Requires valid credentials, limiting immediate enterprise blast radius, but home/SMB deployments remain exposed indefinitely.
Exploit ScenarioDerived	Attacker with valid credentials sends POST request to /goform/formSetDDNS with oversized curTime parameter, triggering stack buffer overflow. Publicly available exploit code exists. Code execution depends on device memory layout and available payloads.

Monitor Track and reassess. Why: Vendor states no customer action required.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Buffer overflow in D-Link DIR-605L 2.13B01 router enables remote code execution via POST request manipulation of curTime parameter in formSetDDNS function. Publicly available exploit code exists. Affected device is end-of-life with no vendor support. Authenticated attacker with low-privilege network access can achieve complete system compromise (high confidentiality, integrity, availability impact per CVSS 4.0 scoring).

RemediationAI

No vendor-released patch identified at time of analysis; D-Link DIR-605L 2.13B01 is end-of-life and unsupported per manufacturer lifecycle policy (https://www.dlink.com/). Primary recommendation: immediately retire and replace device with currently supported hardware from vendor's active product line. Interim risk reduction: disable remote administration interfaces, restrict network access to formSetDDNS endpoint via firewall ACLs permitting only trusted management IP ranges, implement network segmentation isolating device from critical assets. Monitor D-Link security advisories at https://www.dlink.com/ and VulDB tracking page https://vuldb.com/vuln/356537 for any future guidance. Device replacement is the only sustainable long-term remediation given EOL status.

Affected VersionsENISA

DIR-605L 2.13B01

Affected Packages

euvd dir_605l no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-119 memory corruption in /goform/formSetDDNS POST handler. Improper validation of curTime argument causes stack/heap buffer overflow. CVSS vector PR:L indicates authentication required. CPE: cpe:2.3:o:dlink:dir-605l_firmware:2.13b01. Exploitation proof-of-concept published via Notion documentation and VulDB CTI feed.

Know when Dir 605l Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects the function formSetDDNS of the file /goform/formSetDDNS of the component POST Request Handler. Executing a manipulation of the argument curTime can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

CVE-2026-5983 is a buffer overflow vulnerability in end-of-life D-Link DIR-605L routers (firmware 2.13B01) that allows authenticated attackers with network access to execute arbitrary code and completely compromise the device. This affects organizations still operating this legacy hardware, creating a direct path to network infiltration, lateral movement, and data exfiltration without the possibility of vendor remediation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable remote management access and POST requests to the DDNS configuration interface via firewall rules; (2) Restrict network access to the device to trusted administrative subnets only; (3) Implement network segmentation to limit lateral movement if compromise occurs; (4) Monitor for unusual outbound connections from affected devices. These controls are temporary-equipment replacement is the primary remediation path.

Threat Intelligence Overview

EPSS Score

0.0%

Top 86% exploitable

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

Vendor states no customer action required

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +37

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.