CVE-2024-9515 Overview
CVE-2024-9515 is a buffer overflow vulnerability in the D-Link DIR-605L router running firmware version 2.13B01 BETA. The flaw resides in the formSetQoS function of the /goform/formSetQoS endpoint. An attacker can trigger the overflow by manipulating the curTime argument. Exploitation occurs over the network and a proof-of-concept has been publicly disclosed.
Critical Impact
Remote attackers with low privileges can trigger a buffer overflow in formSetQoS, potentially leading to arbitrary code execution or denial of service on affected D-Link DIR-605L routers.
Affected Products
- D-Link DIR-605L router (hardware)
- D-Link DIR-605L firmware version 2.13B01 BETA
- Deployments exposing the web management interface to untrusted networks
Discovery Timeline
- 2024-10-04 - CVE-2024-9515 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9515
Vulnerability Analysis
The vulnerability is a classic stack-based buffer overflow classified as [CWE-120] (Buffer Copy without Checking Size of Input). The affected code path lies in the formSetQoS handler that services requests to /goform/formSetQoS on the router's HTTP administration interface. The handler reads the curTime request parameter and copies it into a fixed-size buffer without validating its length.
An authenticated user submitting a crafted curTime value large enough to exceed the destination buffer can corrupt adjacent stack memory. Depending on the memory layout and MIPS-based firmware protections, this corruption may overwrite the saved return address and redirect execution to attacker-controlled data. Given the DIR-605L's embedded architecture, exploitation typically results in either device crash or code execution in the context of the web management daemon.
Root Cause
The root cause is missing bounds checking when the formSetQoS function processes the curTime HTTP parameter. The firmware relies on unsafe string copy semantics without validating attacker-controlled input length before writing to a fixed-size stack buffer.
Attack Vector
The attack vector is network-based and requires low-level privileges on the web interface. An attacker sends a crafted HTTP POST request to /goform/formSetQoS containing an oversized curTime parameter. The exploit has been publicly disclosed in a GitHub Proof of Concept, lowering the barrier for opportunistic exploitation.
No verified exploitation code is reproduced here. See the linked proof of concept and VulDB entry #279213 for technical exploitation details.
Detection Methods for CVE-2024-9515
Indicators of Compromise
- HTTP POST requests to /goform/formSetQoS containing abnormally long curTime parameter values
- Unexpected reboots or crashes of the router's web management daemon
- Unusual outbound traffic from the router following administrative interface access
- Requests to the router's management interface from external or unexpected internal source addresses
Detection Strategies
- Inspect HTTP traffic destined for the router management interface for oversized parameters targeting /goform/formSetQoS
- Baseline normal administrative access patterns and alert on deviations, including access from non-administrative hosts
- Deploy network intrusion detection signatures matching known payload patterns from the public proof of concept
Monitoring Recommendations
- Monitor router syslog output for repeated crashes or watchdog resets of the httpd process
- Track authentication events against the DIR-605L web interface and alert on brute-force attempts
- Log and review all inbound requests to /goform/* endpoints when the management interface is reachable from untrusted networks
How to Mitigate CVE-2024-9515
Immediate Actions Required
- Disable remote WAN-side administration on the DIR-605L to restrict access to the vulnerable endpoint
- Restrict LAN-side access to the web management interface to a dedicated management VLAN or trusted hosts
- Rotate administrative credentials on the device and enforce strong, unique passwords
- Evaluate replacement of the DIR-605L, as the device is a legacy consumer router that may no longer receive vendor security updates
Patch Information
No vendor security advisory or firmware patch has been published in the referenced sources at the time of NVD publication. Consult the D-Link Official Website support portal for the DIR-605L to check for updated firmware releases addressing formSetQoS.
Workarounds
- Block inbound HTTP and HTTPS requests to the router's WAN interface at the upstream firewall
- Place the router behind a network segment that filters access to /goform/formSetQoS for non-administrative sources
- If the device is end-of-life or no patch is available, replace it with a currently supported router platform
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
