CVE-2026-5980
Published: 09 April 2026
Summary
CVE-2026-5980 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-605L Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-5980 is a buffer overflow vulnerability affecting the D-Link DIR-605L router on firmware version 2.13B01. The flaw exists in the formSetMACFilter function within the /goform/formSetMACFilter file of the POST Request Handler component, where manipulation of the curTime argument triggers the overflow. Associated with CWE-119 and CWE-120, it was published on 2026-04-09 and carries a CVSS v3.1 base score of 8.8.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables high-impact violations of confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope, potentially allowing arbitrary code execution on the affected device.
No patches are available, as the vulnerability only impacts products no longer supported by the maintainer. Advisories from sources like VulDB indicate that a public exploit has been released and is usable, emphasizing the need for immediate isolation or decommissioning of exposed devices. References include detailed entries on VulDB and a D-Link site.
In notable context, the published exploit heightens risks for legacy deployments, with no evidence of AI/ML relevance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21187
Vulnerability details
A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow. The attack may be…
more
initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web form handler (formSetMACFilter) on router enables remote exploitation for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow by requiring validation of manipulated inputs like the curTime argument in the formSetMACFilter POST handler.
Addresses risks from unsupported EOL products like D-Link DIR-605L firmware 2.13B01 by prohibiting their use or isolating them since no patches exist.
Mitigates exploitation of the buffer overflow for arbitrary code execution through memory protections like non-executable stacks and ASLR.