Dir 868L
Monthly
Pre-authentication stack-based buffer overflow in the D-Link DIR-868L router running firmware 2.01b05 allows remote attackers to corrupt memory by sending crafted values in the id or password parameters to /webfa_authentication.cgi, potentially leading to crash or arbitrary code execution on the device. The attack requires only network reachability to the router's HTTP management interface, with no authentication or user interaction (PR:N/UI:N per both the vendor-supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment). Publicly available exploit code exists - a proof-of-concept crash script (poc_crash.py) published on GitHub - but there is no confirmed actively exploited (CISA KEV) status, and the practical attack surface is limited because the web admin interface is typically LAN-only by default, with WAN-side exploitation requiring remote management to be enabled or the device to be internet-exposed; the CVSS 4.0 score of 10.0 conflicts sharply with the realistically constrained exposure and crash-only nature of the published PoC, so the finding warrants caution rather than alarm.
Pre-authentication stack-based buffer overflow in the D-Link DIR-868L router running firmware 2.01b05 allows remote attackers to corrupt memory by sending crafted values in the id or password parameters to /webfa_authentication.cgi, potentially leading to crash or arbitrary code execution on the device. The attack requires only network reachability to the router's HTTP management interface, with no authentication or user interaction (PR:N/UI:N per both the vendor-supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment). Publicly available exploit code exists - a proof-of-concept crash script (poc_crash.py) published on GitHub - but there is no confirmed actively exploited (CISA KEV) status, and the practical attack surface is limited because the web admin interface is typically LAN-only by default, with WAN-side exploitation requiring remote management to be enabled or the device to be internet-exposed; the CVSS 4.0 score of 10.0 conflicts sharply with the realistically constrained exposure and crash-only nature of the published PoC, so the finding warrants caution rather than alarm.