Loading story…
Two high-severity vulnerabilities, CVE-2026-5983 and CVE-2026-5984, were disclosed in the unsupported D-Link DIR-605L router running firmware 2.13B01. Both flaws are remote buffer overflows tied to POST request handlers exposed under /goform/, with the curTime argument identified as the attack vector. CVE-2026-5983 affects the formSetDDNS function in /goform/formSetDDNS, while CVE-2026-5984 affects the formSetLog function in /goform/formSetLog.
The vulnerabilities are classified under CWE-119 and CWE-120 and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a public exploit is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On April 9, 2026, a CVE entry was recorded for CVE-2026-5981, a remotely exploitable buffer overflow in unsupported D-Link DIR-605L firmware 2.13B01. The flaw affects the formAdvFirewall function in the /goform/formAdvFirewall POST handler via the curTime argument, and the disclosure notes public exploit availability or possible active use.
On April 9, 2026, VulDB received CVE-2026-5984 for a remotely exploitable buffer overflow in the unsupported D-Link DIR-605L firmware 2.13B01. The vulnerability is in the formSetLog function of the /goform/formSetLog POST handler, where the curTime argument can trigger the overflow, and a public exploit is noted as available or potentially in use.
On April 9, 2026, VulDB recorded CVE-2026-5983 for a remotely exploitable buffer overflow in the unsupported D-Link DIR-605L firmware 2.13B01. The flaw affects the formSetDDNS function in the /goform/formSetDDNS POST handler via manipulation of the curTime argument, and the entry notes public exploit disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-7288** and **CVE-2026-7289**, were disclosed in **D-Link DIR-825M** firmware **1.1.12**, exposing the router to remotely exploitable buffer overflows. The flaws affect the `/boafrm/formVpnConfigSetup` and `/boafrm/formWanConfigSetup` components, where improper handling of the `submit-url` argument in functions `sub_4151FC` and `sub_414BA8` can trigger memory corruption. Both CVEs were classified under **CWE-119** and **CWE-120** and were assigned high-impact ratings across confidentiality, integrity, and availability. Public exploit information is already available, and one entry notes exploitation is possible with low attack complexity and low privileges, raising the risk of real-world abuse against exposed or improperly managed devices.
Jun 29, 2026
Two router vulnerabilities have been disclosed that expose **D-Link DIR-513** and **Tenda A18 Pro** devices to remotely triggered stack-based buffer overflows. **CVE-2026-4486** affects D-Link DIR-513 version `1.10` in the web service function `formEasySetPassword` at the `/goform/formEasySetPassword` endpoint, where a crafted `curTime` argument can trigger memory corruption. The issue is classified under `CWE-119` and `CWE-121`, and the affected D-Link product is no longer supported by the vendor. A separate flaw, **CVE-2026-4491**, impacts **Tenda A18 Pro** firmware `02.03.02.28` in the `fromSetIpMacBind` function exposed through `/goform/SetIpMacBind`. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as **publicly exploitable**, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Jun 29, 2026
Several high-severity vulnerabilities have been disclosed in the **Tenda F456** router running firmware `1.0.0.5`, affecting the device’s `httpd` component across multiple `/goform/` endpoints. The flaws include `CVE-2026-7053` in `frmL7ProtForm` via `/goform/L7Prot`, `CVE-2026-7055` in `fromVirtualSer` via `/goform/VirtualSer`, `CVE-2026-7056` in `fromSafeUrlFilter` via `/goform/SafeUrlFilter`, and `CVE-2026-7057` in `/goform/setcfm`. In each case, crafted input to parameters such as `page`, `menufacturer`, `Go`, `funcname`, or `funcpara1` can trigger a buffer overflow. The vulnerabilities are described as **remotely exploitable** and have been mapped to `CWE-119` and `CWE-120`, with CVSS scoring indicating high impact to confidentiality, integrity, and availability. Public exploit code has also been reported for all four issues, including references to VulDB and GitHub proof-of-concept material, raising the risk of active attacks against exposed devices. Organizations using affected Tenda F456 routers should treat the flaws as urgent exposure in internet-facing network infrastructure.
Jun 29, 2026