CVE-2023-24348
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on D-Link N300 Wi-Fi Router DIR-605L devices via a stack overflow in the curTime parameter. Attackers can exploit this without authentication to gain full control of affected routers. Only DIR-605L v2.13B01 firmware is affected.
💻 Affected Systems
- D-Link N300 Wi-Fi Router DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as a botnet node.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, credential theft, and network disruption.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though local network attacks remain possible.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository. Exploit requires sending crafted HTTP request to /goform/formSetACLFilter endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: No
Instructions:
No official patch available. D-Link has not released updated firmware. Consider replacing affected hardware.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Access router admin panel > Advanced > Remote Management > Disable
Block access to vulnerable endpoint
linuxUse firewall rules to block access to /goform/formSetACLFilter
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/formSetACLFilter" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected router with supported model
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel under Tools > Firmware. If version is v2.13B01, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
No fix available to verify. Only complete mitigation is hardware replacement.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/formSetACLFilter with malformed curTime parameter
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router port 80 with POST to vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/formSetACLFilter" OR method="POST" AND uri CONTAINS "formSetACLFilter")