CVE-2024-9561
📋 TL;DR
A critical buffer overflow vulnerability in D-Link DIR-605L routers allows remote attackers to execute arbitrary code by manipulating the curTime parameter in formSetWAN_Wizard functions. This affects users of DIR-605L routers running firmware version 2.13B01 BETA. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- D-Link DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and pivot to internal networks.
Likely Case
Router takeover enabling DNS hijacking, network monitoring, or botnet recruitment.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
1. Check D-Link website for security advisories
2. If no patch available, consider workarounds or replacement
3. Beta firmware should be upgraded to stable release
🔧 Temporary Workarounds
Network Isolation
allPlace router behind firewall with restricted WAN access
Firmware Downgrade
allRevert to previous stable firmware version
Download stable firmware from D-Link support portal and flash via admin interface
🧯 If You Can't Patch
- Replace DIR-605L with supported router model
- Disable remote administration and WAN access to web interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface (typically 192.168.0.1 or 192.168.1.1)Check Version:
curl -s http://router-ip/status.html | grep FirmwareVerify Fix Applied:
Verify firmware version is NOT 2.13B01 BETA📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to formSetWAN_Wizard51 or formSetWAN_Wizard52 endpoints
- Router reboot events
- Configuration changes
Network Indicators:
- Exploit traffic patterns to router web interface
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="*formSetWAN_Wizard*" OR message="*curTime*")