A critical buffer overflow vulnerability in the D-Link DIR-605L router allows for remote code execution via a manipulated network parameter.

This flaw is a buffer overflow (CWE-120) occurring in the formAdvNetwork function of the POST request handler, triggered by manipulating the curTime argument. The vulnerability requires low privileges (authenticated) to execute, as indicated by the CVSS vector.

Successful exploitation allows an attacker to achieve remote code execution on the affected router. Given the CVSS score of 8.8, this poses a severe risk of total system compromise, potentially enabling attackers to intercept network traffic, pivot into internal segments, or persistently control the device. Because the product is no longer supported, the risk of unpatched compromise is extreme.

Immediate Action: As the affected hardware is end-of-life and no vendor patch is available, immediately isolate the device from external network exposure or replace it with a currently supported model.

Proactive Monitoring: Monitor network access logs for suspicious POST requests directed at the /goform/formAdvNetwork URI, particularly those containing abnormally long strings in the curTime parameter.

Compensating Controls: Implement strict firewall rules to restrict access to the router management interface to trusted internal IP addresses only, and disable remote management features if they are not strictly necessary.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up referenced by the CVE record.

This vulnerability represents a significant security risk for the D-Link DIR-605L, which is no longer receiving security updates from the manufacturer. Organizations currently utilizing this hardware should prioritize its immediate decommissioning and replacement to eliminate the risk of remote compromise. If immediate replacement is not feasible, restrict access to the device to the absolute minimum level possible to mitigate the attack surface.