CVE-2024-9561: D-Link DIR-605L Buffer Overflow Vulnerability

CVE-2024-9561 Overview

CVE-2024-9561 is a buffer overflow vulnerability in D-Link DIR-605L routers running firmware version 2.13B01 BETA. The flaw resides in the formSetWAN_Wizard51 and formSetWAN_Wizard52 functions, where the curTime argument is processed without proper bounds checking. Remote attackers can trigger the overflow over the network to corrupt memory on the affected device. The exploit has been publicly disclosed, increasing the risk of opportunistic attack against exposed devices. D-Link has not published a vendor advisory for this issue in the referenced data.

Critical Impact
Remote attackers with low-privilege access can trigger a buffer overflow in the WAN wizard handlers, potentially leading to memory corruption and code execution on the router.

Affected Products

D-Link DIR-605L firmware version 2.13B01 BETA
D-Link DIR-605L hardware router
Deployments exposing the router web management interface to untrusted networks

Discovery Timeline

2024-10-06 - CVE-2024-9561 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9561

Vulnerability Analysis

The vulnerability affects the WAN configuration wizard endpoints of the DIR-605L web management interface. Both formSetWAN_Wizard51 and formSetWAN_Wizard52 accept a curTime request parameter and copy the value into a fixed-size buffer without validating its length. Supplying an oversized value overflows the destination buffer and corrupts adjacent stack memory.

Because the vulnerable handlers are reachable over the network via HTTP requests to the router, an authenticated attacker can send a crafted request that triggers the overflow. Successful exploitation can crash the HTTP daemon or, depending on memory layout, enable execution of attacker-supplied instructions in the context of the web management process. The issue is classified under CWE-120: Buffer Copy without Checking Size of Input.

Root Cause

The underlying defect is missing length validation on user-controlled input before a copy into a stack buffer. The curTime parameter is treated as trusted data, and no boundary check restricts its size prior to the copy operation.

Attack Vector

Exploitation requires network access to the router management interface and a low-privileged account on the device. An attacker sends an HTTP request to formSetWAN_Wizard51 or formSetWAN_Wizard52 with an overly long curTime value. The oversized value overwrites stack memory, disrupting execution flow or crashing the process.

Technical details of the crafted request are documented in the public write-up hosted in the GitHub IoT Vulnerability Documentation and the VulDB Vulnerability ID #279369 entry.

Detection Methods for CVE-2024-9561

Indicators of Compromise

Unexpected reboots or crashes of the DIR-605L web management daemon
HTTP POST requests to /formSetWAN_Wizard51 or /formSetWAN_Wizard52 containing abnormally long curTime parameter values
Unauthorized WAN configuration changes appearing in router logs
Outbound connections from the router to unfamiliar hosts following administrative requests

Detection Strategies

Inspect HTTP traffic to the router administration interface for curTime parameters exceeding expected timestamp length
Alert on repeated malformed requests to the WAN wizard endpoints from a single source
Correlate router availability events with recent management-plane HTTP activity

Monitoring Recommendations

Forward router syslog and HTTP access logs to a central log repository for retention and analysis
Monitor for management interface exposure on WAN-side interfaces using external attack surface scans
Track firmware version inventory to flag unpatched DIR-605L 2.13B01 BETA units

How to Mitigate CVE-2024-9561

Immediate Actions Required

Restrict access to the router administration interface to trusted management VLANs or hosts only
Disable remote WAN-side management on the DIR-605L until a fix is available
Rotate router administrator credentials and enforce strong passwords to reduce the pool of low-privileged accounts an attacker could leverage
Consider replacing the DIR-605L with a currently supported model, since the affected firmware is a BETA release and no vendor patch is referenced

Patch Information

No vendor patch is listed in the referenced advisories for CVE-2024-9561. The DIR-605L is a legacy consumer router, and affected users should consult the D-Link Official Website for the latest support status and firmware availability. If no fix is released, migration to a supported device is the durable remediation.

Workarounds

Block inbound HTTP and HTTPS access to the router management interface at the perimeter
Place the router management interface on a segmented network reachable only from administrator workstations
Deploy an upstream firewall to filter requests containing oversized parameters targeting formSetWAN_Wizard51 and formSetWAN_Wizard52

bash

# Example iptables rule to restrict router admin access to a trusted host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP