CVE-2024-9553: D-Link DIR-605L Buffer Overflow Vulnerability

CVE-2024-9553 Overview

CVE-2024-9553 is a buffer overflow vulnerability in the D-Link DIR-605L router running firmware version 2.13B01 BETA. The flaw resides in the formdumpeasysetup function of the /goform/formdumpeasysetup endpoint. Attackers can trigger the overflow by manipulating the curTime argument through a crafted HTTP request. The vulnerability is remotely exploitable and a public proof-of-concept has been disclosed. The weakness is classified as CWE-120, buffer copy without checking size of input.

Critical Impact
Remote attackers with low privileges can trigger a buffer overflow on affected D-Link DIR-605L devices, potentially leading to memory corruption, denial of service, or arbitrary code execution on the router.

Affected Products

D-Link DIR-605L hardware router
D-Link DIR-605L firmware version 2.13B01 BETA
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2024-10-06 - CVE-2024-9553 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9553

Vulnerability Analysis

The vulnerability lives in the formdumpeasysetup handler served under the /goform/ path of the DIR-605L web management interface. This handler processes the curTime HTTP parameter and copies its contents into a fixed-size stack buffer without validating the input length. An attacker sending a long curTime value overruns the buffer and corrupts adjacent memory on the router.

The DIR-605L is a consumer-grade device that has reached end-of-life status. D-Link has historically declined to issue firmware fixes for legacy products in this class. Exploitation requires network access to the web interface, which in many home and small-office deployments is reachable from the LAN and, when remote administration is enabled, from the WAN.

Root Cause

The root cause is missing bounds checking on user-supplied input, categorized as [CWE-120]. The formdumpeasysetup function trusts the length of the curTime argument and performs an unsafe copy operation into a stack-allocated buffer. Because the firmware is a MIPS-based embedded Linux image without modern exploit mitigations such as stack canaries or reliable ASLR, corruption of the saved return address can redirect execution to attacker-controlled data.

Attack Vector

Exploitation occurs over the network against the router's HTTP management service. An attacker crafts a POST request to /goform/formdumpeasysetup containing an oversized curTime value. The request requires low privileges, consistent with the CVSS vector PR:L, indicating that authentication to the web UI is expected. Successful exploitation can crash the device, cause reboots, or lead to arbitrary code execution in the context of the router's HTTP daemon.

A public proof-of-concept is documented in the GitHub PoC for D-Link DIR-605L repository. Additional metadata is tracked under VulDB ID #279351.

Detection Methods for CVE-2024-9553

Indicators of Compromise

HTTP POST requests targeting /goform/formdumpeasysetup with abnormally long curTime parameter values
Unexpected reboots, watchdog resets, or crashes of the DIR-605L HTTP daemon
Unauthorized configuration changes on the router following suspicious web-admin traffic
Outbound connections from the router to unfamiliar hosts after web-interface access

Detection Strategies

Inspect network telemetry for HTTP requests to /goform/formdumpeasysetup originating from untrusted sources
Alert on POST bodies containing curTime values exceeding a reasonable length threshold (for example, more than 64 bytes)
Correlate router availability events with preceding web-admin traffic to identify crash-inducing requests
Fingerprint DIR-605L devices running firmware 2.13B01 BETA on the network and flag exposure of their management interfaces

Monitoring Recommendations

Forward router syslog and firewall logs to a centralized log analytics platform for continuous review
Monitor DHCP and DNS traffic for signs of router configuration tampering, such as changed DNS servers
Track WAN-side access attempts to router management ports (80/tcp, 443/tcp, 8080/tcp)
Baseline management-interface traffic so anomalous POSTs to /goform/ endpoints trigger alerts

How to Mitigate CVE-2024-9553

Immediate Actions Required

Disable remote (WAN) management on the DIR-605L web interface
Restrict LAN-side access to the router's admin UI to a dedicated management VLAN or trusted hosts
Change the default administrator password and enforce a strong credential policy
Plan replacement of the DIR-605L, as this model is end-of-life and unlikely to receive vendor patches

Patch Information

At the time of publication, no vendor patch is listed on the D-Link Official Website for CVE-2024-9553. The DIR-605L is a legacy product, and D-Link has previously communicated that end-of-life devices will not receive further firmware updates. Affected owners should treat replacement with a currently supported router as the primary remediation path.

Workarounds

Block inbound access to /goform/formdumpeasysetup at an upstream firewall or gateway
Disable the router's HTTP administration service where a CLI or offline configuration workflow is acceptable
Segment the router onto an isolated management network and prevent guest or IoT clients from reaching its web interface
Replace the DIR-605L with a vendor-supported device that receives active security updates

bash

# Configuration example: block external access to the router admin UI
# Example using iptables on an upstream Linux gateway
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 8080 -j DROP