CVE-2026-5984
Published: 09 April 2026
Summary
CVE-2026-5984 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-605L Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates the curTime argument in POST requests to the formSetLog handler, directly preventing the buffer overflow manipulation.
Implements memory safeguards such as non-executable stacks and address space randomization to block arbitrary code execution from the buffer overflow exploit.
Requires replacement or prohibition of unsupported end-of-life components like the D-Link DIR-605L, eliminating exposure to unpatchable buffer overflow vulnerabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web form handler (formSetLog) is remotely exploitable with low privileges leading to RCE, directly mapping to exploitation of public-facing application and privilege escalation.
NVD Description
A vulnerability was identified in D-Link DIR-605L 2.13B01. Impacted is the function formSetLog of the file /goform/formSetLog of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. The attack is possible to be carried…
more
out remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-5984 is a buffer overflow vulnerability affecting the D-Link DIR-605L router on firmware version 2.13B01. The flaw exists in the formSetLog function of the /goform/formSetLog file within the POST Request Handler component, where manipulation of the curTime argument triggers the overflow. Associated with CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is remotely exploitable over the network with low attack complexity and requires only low privileges, such as those of an authenticated user. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.
This issue impacts products no longer supported by the maintainer, meaning no official patches or updates are available. Advisories from VulDB detail the vulnerability and note that a public exploit exists which might be used; further information is available via references including https://vuldb.com/vuln/356538 and https://www.dlink.com/. Practitioners should isolate or retire affected devices.
Details
- CWE(s)