A critical buffer overflow vulnerability in D-Link DIR600L routers allows unauthenticated attackers to cause a denial of service condition.

This is a buffer overflow vulnerability located in the formSetEmail function of the device firmware. The flaw is reachable by an unauthenticated attacker sending a crafted request to the curTime parameter.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation results in a denial of service, which can disrupt network connectivity and impact business operations that rely on this hardware for communication or internet access.

Immediate Action: Since no official patch is currently available, users should restrict administrative access to the device and prevent exposure to the public internet.

Proactive Monitoring: Monitor network traffic for anomalous requests directed at the device management interface, specifically those targeting email configuration parameters.

Compensating Controls: Implement firewall rules to block unauthorized inbound connections to the router management interface, effectively reducing the attack surface.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the high severity of the vulnerability, administrators must treat this as a significant risk. If a firmware update is not provided by D-Link, consider replacing the affected hardware with a supported device to ensure ongoing security.