CVE-2023-24347
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on D-Link DIR-605L routers via a stack overflow in the webpage parameter. Attackers can exploit this to gain full control of affected routers. Only D-Link DIR-605L v2.13B01 routers are affected.
💻 Affected Systems
- D-Link N300 WI-FI Router DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise leading to persistent backdoor installation, credential theft, network traffic interception, and lateral movement to connected devices.
Likely Case
Router takeover enabling DNS hijacking, credential harvesting, and botnet recruitment for DDoS attacks.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept code demonstrating the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: No
Instructions:
No official patch available. Consider replacing affected hardware with supported models.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected routers with supported models receiving security updates
- Implement strict firewall rules blocking all inbound traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or using 'nmap -sV -p80,443 [router-ip]'Check Version:
curl -s http://192.168.0.1/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is no longer v2.13B01 (though no patch exists)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formSetWanDhcpplus with long webpage parameters
- Router reboot events following suspicious requests
Network Indicators:
- HTTP requests with abnormally long parameter values to router management interface
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/goform/formSetWanDhcpplus" AND parameter_length>1000