CVE-2026-5983
Published: 09 April 2026
Summary
CVE-2026-5983 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-605L Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5983 is a buffer overflow vulnerability in the D-Link DIR-605L router running firmware version 2.13B01. The issue resides in the formSetDDNS function within the /goform/formSetDDNS file of the POST Request Handler component. By manipulating the curTime argument, an attacker can trigger the overflow, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. Exploitation requires network access and low privileges (such as those of an authenticated user), with low attack complexity and no user interaction needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing remote code execution on the affected device.
This vulnerability affects only D-Link DIR-605L products that are no longer supported by the manufacturer, implying no official patches or updates are available. The exploit has been publicly disclosed, as detailed in referenced advisories including a Notion site and VulDB entries, increasing the risk of utilization against unpatched, end-of-life devices. The D-Link website provides general product information but no specific mitigation guidance for this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21222
Vulnerability details
A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects the function formSetDDNS of the file /goform/formSetDDNS of the component POST Request Handler. Executing a manipulation of the argument curTime can lead to buffer overflow. The attack can be…
more
executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the router's public-facing web form handler (formSetDDNS) directly enables remote code execution via exploitation of a public-facing application over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the curTime argument in POST requests to the formSetDDNS handler, directly preventing the buffer overflow from improper input restrictions.
Implements memory protections like stack canaries, ASLR, and DEP to comprehensively mitigate exploitation of the buffer overflow vulnerability.
Provides processes to identify, prioritize, and remediate the known buffer overflow flaw, including mitigations for end-of-life firmware lacking patches.