{"id":"CVE-2026-5980","state":"PUBLISHED","title":"D-Link DIR-605L POST Request formSetMACFilter buffer overflow","description":"A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.","publishedAt":"2026-04-09T21:00:23.939Z","updatedAt":"2026-04-10T14:05:53.814Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["D-Link DIR-605L"],"affected":[{"vendor":"D-Link","product":"DIR-605L","versions":[{"version":"2.13B01","status":"affected"}],"modules":["POST Request Handler"]}],"references":["https://vuldb.com/vuln/356534","https://vuldb.com/vuln/356534/cti","https://vuldb.com/submit/791853","https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetMACFilter-33153a41781f807c8fb4c3a75f7b555e?source=copy_link","https://www.dlink.com/"],"weaknesses":["CWE-120","CWE-119"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5980.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5980","state":"PUBLISHED","datePublished":"2026-04-09T21:00:23.939Z","dateUpdated":"2026-04-10T14:05:53.814Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-09T12:18:20.626Z"},"containers":{"cna":{"title":"D-Link DIR-605L POST Request formSetMACFilter buffer overflow","descriptions":[{"lang":"en","value":"A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer."}],"affected":[{"vendor":"D-Link","product":"DIR-605L","versions":[{"version":"2.13B01","status":"affected"}],"modules":["POST Request Handler"]}],"references":[{"url":"https://vuldb.com/vuln/356534","name":"VDB-356534 | D-Link DIR-605L POST Request formSetMACFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356534/cti","name":"VDB-356534 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791853","name":"Submit #791853 | D-Link DIR-605L D-Link DIR-605L 2.13B01 BETA Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetMACFilter-33153a41781f807c8fb4c3a75f7b555e?source=copy_link","tags":["exploit"]},{"url":"https://www.dlink.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","baseSeverity":"HIGH"}},{"cvssV3_1":{"version":"3.1","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":9,"vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","type":"CWE","lang":"en","description":"Buffer Overflow"}]},{"descriptions":[{"cweId":"CWE-119","type":"CWE","lang":"en","description":"Memory Corruption"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-09T21:00:23.939Z"},"timeline":[{"time":"2026-04-09T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-09T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-09T14:23:55.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"wxhwxhwxh_mie (VulDB User)","type":"reporter"}],"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-10T14:05:41.763254Z","id":"CVE-2026-5980","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-10T14:05:53.814Z"}}]}}}