CVE-2024-9565: D-Link DIR-605L Buffer Overflow Vulnerability

CVE-2024-9565 Overview

CVE-2024-9565 is a buffer overflow vulnerability in the D-Link DIR-605L router firmware version 2.13B01 BETA. The flaw resides in the formSetPassword function within the /goform/formSetPassword endpoint. Attackers can trigger the overflow by manipulating the curTime argument during an HTTP request to the router's web interface. The vulnerability is remotely exploitable and has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed devices. The DIR-605L is a legacy consumer wireless router, and administrators of remaining deployments should evaluate replacement options.

Critical Impact
Remote attackers with low-privileged access to the web management interface can trigger memory corruption, potentially leading to arbitrary code execution or denial of service on the router.

Affected Products

D-Link DIR-605L Router (hardware)
D-Link DIR-605L Firmware version 2.13B01 BETA
Legacy DIR-605L deployments exposing the web administration interface

Discovery Timeline

2024-10-07 - CVE-2024-9565 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9565

Vulnerability Analysis

The vulnerability is a classic stack or heap buffer overflow [CWE-120] within the formSetPassword handler of the DIR-605L web administration interface. The handler processes the curTime parameter without enforcing bounds checks on the input length. Supplying an oversized value overwrites adjacent memory regions in the httpd process handling the request.

Because the DIR-605L runs as an embedded Linux device with limited exploit mitigations, memory corruption in the web server process can influence control flow. Attackers who successfully exploit the flaw may achieve arbitrary code execution in the context of the router's management daemon. Successful exploitation compromises confidentiality, integrity, and availability of the device.

Exploitation requires network reachability to the router's HTTP interface and authenticated access at a low privilege level. Devices with WAN-side management enabled are exposed to internet-based attackers.

Root Cause

The root cause is the absence of input length validation on the curTime argument before it is copied into a fixed-size buffer inside formSetPassword. This is a Classic Buffer Copy Without Checking Size of Input weakness as defined by CWE-120.

Attack Vector

An authenticated attacker submits a crafted HTTP POST request to /goform/formSetPassword containing an oversized curTime parameter value. The request originates over the network and requires no user interaction. Technical exploitation details are documented in the public GitHub Vulnerability Documentation and the VulDB Threat Intelligence Report.

The vulnerability manifests when the router's httpd binary copies the attacker-supplied curTime value into a fixed-size stack or heap buffer without length checks. See the referenced advisory for parameter structure and reproduction steps.

Detection Methods for CVE-2024-9565

Indicators of Compromise

HTTP POST requests to /goform/formSetPassword containing unusually long curTime parameter values
Unexpected reboots, service restarts, or httpd crashes on DIR-605L devices
New or modified administrator accounts on the router web interface
Outbound connections from the router to unfamiliar hosts, indicating potential post-exploitation activity

Detection Strategies

Inspect router web server access logs for POST requests to /goform/formSetPassword with abnormal payload sizes
Deploy network intrusion detection signatures that flag oversized parameters in requests targeting D-Link /goform/ endpoints
Monitor for repeated authentication attempts against the router administrative interface preceding suspicious requests

Monitoring Recommendations

Enable syslog forwarding from the router to a centralized log store for retention and analysis
Alert on any administrative access to legacy embedded devices from non-management network segments
Track device availability and unexpected reboot cycles that may indicate exploitation attempts

How to Mitigate CVE-2024-9565

Immediate Actions Required

Disable remote (WAN-side) administration on all DIR-605L devices immediately
Restrict access to the LAN-side web management interface to a dedicated management VLAN or trusted hosts
Rotate all router administrator credentials and enforce strong passwords
Plan replacement of DIR-605L hardware, which is a legacy consumer product

Patch Information

No vendor patch is currently referenced in the CVE data for CVE-2024-9565. The DIR-605L is a legacy D-Link product and firmware version 2.13B01 BETA remains vulnerable. Consult the D-Link Official Website for end-of-life status and firmware availability. Where no fix is provided, migrating to a supported router platform is the recommended long-term remediation.

Workarounds

Segment the router onto an isolated management network to eliminate exposure from user endpoints
Place the device behind an upstream firewall that filters HTTP requests to /goform/formSetPassword
Decommission and replace DIR-605L devices where the web management interface cannot be adequately isolated

bash

# Example: block external access to router admin interface at upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP