CVE-2012-10021

The vulnerability results from unsafe use of the sprintf() function in the getAuthCode() function when processing user-supplied CAPTCHA data. The attacker sends a crafted request to the /goform/formLogin endpoint, passing an excessively long value for the FILECODE parameter. The lack of input length verification causes a stack-based buffer overflow, which allows overwriting the return address and hijacking program execution flow. As a result, the attacker can execute arbitrary code with root privileges on the vulnerable device.

An attacker can remotely execute arbitrary code (RCE) with root privileges on the device, gaining full control over the router without requiring any authentication credentials.

Apply patches available from the manufacturer according to the references. Due to the age of the device and firmware, verify the availability of updates from the manufacturer (D-Link); if an update is not available, it is recommended to isolate the device from the public internet, restrict access to the administrative panel exclusively to trusted local networks, and consider replacing the device with a model supported by the manufacturer.

D-Link DIR-605L Wireless N300 Cloud Router with firmware version 1.12 and 1.13