D-Link DIR-605 EUVD-2026-72339

The L2TP service must be active and reachable on the DIR-605 - this is a network-facing daemon typically listening on UDP port 1701. No authentication is required prior to parsing the Host Name AVP in control messages; the vulnerable code path is exercised during the L2TP tunnel setup handshake before credentials are exchanged. Exploitation is limited by high attack complexity (AC:H): the attacker must craft a payload that achieves a deterministic out-of-bounds write, which requires knowledge of the target's memory layout - typical in embedded firmware where ASLR and heap randomization are absent or weak. The vulnerability does not require any user interaction or special device configuration beyond the L2TP service being enabled and reachable.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.2, reflecting network-reachable unauthenticated exploitation against a full-compromise impact baseline, but tempered by high attack complexity (AC:H). The supplemental E:P modifier confirms a public exploit exists (the Notion-hosted PoC writeup). KEV status is not confirmed, so this is not yet listed as actively exploited by CISA. The combination of AC:H and a legacy consumer router creates a nuanced picture: the high C/I/A rating is plausible given that an OOB write in a privileged network daemon on embedded Linux can realistically lead to RCE, but the difficulty qualifier means mass automated exploitation is unlikely. The product is almost certainly end-of-life with no vendor patch forthcoming, making even difficult exploitation more relevant for targeted scenarios against exposed L2TP endpoints. The 'Information Disclosure' tag in the input metadata understates the true impact - the PoC explicitly names this an out-of-bounds write, which supports integrity and availability impact, not merely confidentiality.

An attacker on the internet sends a crafted L2TP control message containing an oversized or malformed Host Name AVP to the DIR-605's L2TP listener on UDP port 1701. The off-by-one error in tunnel_set_params triggers an out-of-bounds write adjacent to the peer_hostname buffer, corrupting heap or stack metadata. With the public PoC as a reference, a sufficiently skilled attacker could develop this into arbitrary code execution running as the pppd daemon, achieving full device compromise. The high attack complexity (AC:H) reflects the need to engineer reliable memory layout control for exploitation.