CVE-2024-9514: D-Link DIR-605L Buffer Overflow Vulnerability

CVE-2024-9514 Overview

CVE-2024-9514 is a buffer overflow vulnerability in the D-Link DIR-605L router running firmware version 2.13B01 BETA. The flaw resides in the formSetDomainFilter function accessible through the /goform/formSetDomainFilter endpoint. Attackers can trigger the overflow by manipulating the curTime argument. The vulnerability is remotely exploitable and has been publicly disclosed, increasing the risk of exploitation against exposed devices. The weakness maps to [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
Remote attackers with low privileges can send crafted HTTP requests to overflow the curTime buffer, potentially achieving arbitrary code execution or denial of service on affected D-Link DIR-605L routers.

Affected Products

D-Link DIR-605L router hardware
D-Link DIR-605L firmware version 2.13B01 BETA
Deployments exposing the router web management interface to untrusted networks

Discovery Timeline

2024-10-04 - CVE-2024-9514 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9514

Vulnerability Analysis

The vulnerability exists in the formSetDomainFilter handler within the router's web management interface. The handler processes HTTP POST requests submitted to /goform/formSetDomainFilter, which is used to configure domain-based content filtering rules. The handler reads the curTime parameter from the request without validating its length before copying it into a fixed-size stack buffer.

This unchecked copy operation triggers a classic stack-based buffer overflow. An attacker supplying an oversized curTime value overwrites adjacent stack memory, including saved return addresses. On MIPS-based D-Link firmware, corrupting the return address enables ROP-style redirection of control flow to attacker-controlled shellcode or existing gadgets.

The D-Link DIR-605L reached end-of-life status, and no vendor patch has been announced for this firmware branch.

Root Cause

The root cause is the absence of bounds checking during string handling of the curTime parameter inside formSetDomainFilter. The function uses unsafe copy primitives such as strcpy or sprintf against a fixed stack buffer. This pattern is common in older embedded HTTP CGI handlers and matches the [CWE-120] classification.

Attack Vector

Exploitation requires network access to the router's administrative interface and low-privilege authentication. An attacker sends a crafted HTTP request to /goform/formSetDomainFilter with an overlong curTime value. Devices exposed to the internet through remote management or misconfigured firewall rules face the highest exposure. See the GitHub vulnerability documentation and VulDB entry #279214 for reproduction details.

Detection Methods for CVE-2024-9514

Indicators of Compromise

HTTP POST requests to /goform/formSetDomainFilter containing abnormally long curTime parameter values
Unexpected router reboots, httpd crashes, or web interface unavailability following inbound HTTP traffic
Outbound connections from the router to unfamiliar IP addresses after receiving crafted management requests
Modification of domain filter configuration entries without administrator action

Detection Strategies

Inspect network traffic for POST requests targeting /goform/formSetDomainFilter and flag parameter lengths exceeding typical values
Deploy intrusion detection signatures that match oversized curTime values in HTTP request bodies destined for D-Link management interfaces
Correlate router syslog events indicating process restarts with preceding inbound HTTP administrative activity

Monitoring Recommendations

Restrict router management interfaces to isolated management VLANs and monitor east-west traffic to those segments
Enable centralized logging from network devices and forward events to a SIEM for anomaly correlation
Alert on any external source attempting to reach the router HTTP administration port

How to Mitigate CVE-2024-9514

Immediate Actions Required

Disable remote (WAN-side) management on all D-Link DIR-605L devices
Restrict LAN-side access to the router web interface using ACLs limiting administrative subnets
Change default and weak administrator credentials to reduce the low-privilege prerequisite for exploitation
Inventory all DIR-605L devices in the environment and prioritize replacement given end-of-life status

Patch Information

The D-Link DIR-605L is an end-of-life product, and no official patch has been published for firmware 2.13B01 BETA addressing CVE-2024-9514. Refer to the D-Link official website for end-of-life product notices and replace affected devices with actively supported hardware.

Workarounds

Replace the DIR-605L with a currently supported router model that receives security updates
Place the router behind a perimeter firewall that blocks unsolicited inbound traffic to management ports
Segment IoT and legacy network devices from user and server networks to contain post-exploitation movement
Disable the domain filter feature if the workflow permits, reducing exposure of the vulnerable handler

bash

# Example: block external access to router management interface using iptables upstream
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -m iprange \
  ! --src-range 10.0.0.0-10.0.0.255 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -m iprange \
  ! --src-range 10.0.0.0-10.0.0.255 -j DROP