CVE-2024-9555: D-Link DIR-605L Buffer Overflow Vulnerability

CVE-2024-9555 Overview

CVE-2024-9555 is a buffer overflow vulnerability in the D-Link DIR-605L wireless router running firmware version 2.13B01 BETA. The flaw resides in the formSetEasy_Wizard function of the /goform/formSetEasy_Wizard endpoint. Attackers can trigger the overflow by manipulating the curTime argument submitted to the vulnerable form handler. The issue is remotely exploitable across the network, and the exploit has been publicly disclosed. The vulnerability is classified under CWE-120, which covers classic buffer copy operations without size checks.

Critical Impact
Remote attackers with low privileges can exploit the curTime parameter to corrupt memory, potentially leading to arbitrary code execution or denial of service on affected D-Link DIR-605L routers.

Affected Products

D-Link DIR-605L router (hardware)
D-Link DIR-605L firmware version 2.13B01 BETA
Devices exposing the /goform/formSetEasy_Wizard web management endpoint

Discovery Timeline

2024-10-06 - CVE-2024-9555 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9555

Vulnerability Analysis

The vulnerability exists in the router's embedded HTTP server, specifically in the formSetEasy_Wizard handler responsible for processing the Easy Setup Wizard form submissions. The handler reads the curTime argument from the incoming HTTP request and copies it into a fixed-size stack or heap buffer without validating the input length. Because the copy operation lacks bounds checking, an oversized curTime value overwrites adjacent memory. Successful exploitation can compromise confidentiality, integrity, and availability of the device. The DIR-605L has reached end-of-life status, meaning no official firmware fix is expected.

Root Cause

The root cause is a classic buffer copy without checking the size of the input, categorized as CWE-120. The formSetEasy_Wizard function trusts the length of the curTime HTTP parameter and passes it to an unsafe string copy routine such as strcpy or sprintf. This pattern is common in MIPS-based D-Link firmware where CGI-style handlers extract parameters using helper functions and copy them into stack buffers.

Attack Vector

An attacker sends a crafted HTTP POST request to /goform/formSetEasy_Wizard containing an overly long curTime value. The request can be delivered remotely if the router's web interface is exposed to untrusted networks, or from within the LAN by any user with access to the management page. The attacker requires low privileges based on the CVSS 4.0 vector. The public disclosure of the exploit on GitHub increases the likelihood of opportunistic scanning and exploitation attempts against exposed devices. See the technical write-up for details on the request structure and the vulnerable code path.

Detection Methods for CVE-2024-9555

Indicators of Compromise

HTTP POST requests to /goform/formSetEasy_Wizard containing abnormally long curTime parameter values
Unexpected reboots, crashes, or watchdog resets on DIR-605L devices following inbound web requests
New outbound connections from the router to unknown IP addresses, indicating possible post-exploitation implant activity
Changes to DNS settings, admin credentials, or firmware images on affected routers

Detection Strategies

Inspect web server access logs on the router or upstream proxies for POST requests to /goform/formSetEasy_Wizard with parameter lengths exceeding normal bounds
Deploy network intrusion detection signatures that match oversized curTime values in HTTP payloads targeting D-Link management endpoints
Monitor for unauthenticated or low-privilege access attempts to /goform/ URIs from external networks

Monitoring Recommendations

Alert on any inbound traffic to the router's HTTP management interface from outside the trusted LAN
Track device availability and configuration drift for DIR-605L units still in production
Correlate router-originated network events with endpoint telemetry to identify lateral movement from a compromised router

How to Mitigate CVE-2024-9555

Immediate Actions Required

Disable remote administration on the DIR-605L web interface and restrict management access to trusted LAN hosts only
Segment vulnerable routers onto isolated network zones and block inbound access to /goform/formSetEasy_Wizard at upstream firewalls
Rotate administrative credentials and review router configuration for unauthorized changes
Replace end-of-life DIR-605L hardware with a currently supported model that receives security updates

Patch Information

No vendor patch is available at the time of publication. The D-Link DIR-605L has reached end-of-life, and D-Link has historically recommended retirement rather than firmware updates for devices in this status. Consult the D-Link official website for the latest support statements and refer to the VulDB entry for tracking updates.

Workarounds

Block external access to TCP ports used by the router's HTTP administration interface (typically 80/443) at the perimeter
Restrict LAN-side access to the management interface using access control lists that permit only authorized administrator workstations
Decommission the DIR-605L and migrate to a supported router platform to eliminate exposure to unpatched vulnerabilities

bash

# Configuration example: block external HTTP access to the router management interface
# Example iptables rule applied on an upstream gateway
iptables -A FORWARD -d <router-ip> -p tcp --dport 80 -m state \
    --state NEW -j DROP
iptables -A FORWARD -d <router-ip> -p tcp --dport 443 -m state \
    --state NEW -j DROP