Cyber Resilience

CVE-2024-9570

HighPublic PoC

Published: 07 October 2024

Published
07 October 2024
Modified
09 October 2024
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.2363 96.1th percentile
Risk Priority 32 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-9570 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Dir-619L Firmware. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A vulnerability classified as critical exists in the D-Link DIR-619L B1 firmware version 2.06. It resides in the formEasySetTimezone function of the /goform/formEasySetTimezone endpoint, where improper handling of the curTime argument triggers a buffer overflow (CWE-120). The flaw is remotely reachable and carries a CVSS 4.0 score of 8.7 reflecting high impact on confidentiality, integrity, and availability.

An attacker with low privileges can send a crafted HTTP request to the affected endpoint and trigger the overflow, potentially achieving arbitrary code execution or denial of service on the device. Public proof-of-concept code has already been released, lowering the barrier for exploitation.

Vendor references direct users to D-Link for firmware updates or further guidance, while third-party trackers such as VulDB document the issue and link to the disclosed exploit. No additional mitigation details beyond standard device hardening are provided in the available advisories.

EPSS for this CVE rose from a low baseline to a peak of 0.3514 before receding to the current value of 0.2363, indicating measurable post-disclosure interest in exploitation attempts.

EU & UK References

Vulnerability details

A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched…

more

remotely. The exploit has been disclosed to the public and may be used.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Buffer overflow in the router's web interface (/goform/formEasySetTimezone) enables remote exploitation of a public-facing application and remote service for potential RCE.

Affected Assets

dlink
dir-619l firmware
2.06b1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

References