Dir 605
Monthly
Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the `peer_hostname` argument of `tunnel_set_params`. The flaw resides in the router's L2TP Control Message Parser (`progs.gpl/pppd.alpha/l2tp/tunnel.c`) and carries full C/I/A impact on the device. A public proof-of-concept writeup explicitly confirming out-of-bounds write primitives has been published, though exploitation complexity is rated high.
Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the `peer_hostname` argument of `tunnel_set_params`. The flaw resides in the router's L2TP Control Message Parser (`progs.gpl/pppd.alpha/l2tp/tunnel.c`) and carries full C/I/A impact on the device. A public proof-of-concept writeup explicitly confirming out-of-bounds write primitives has been published, though exploitation complexity is rated high.