CriticalPublic exploit

Stack-based buffer overflow in D-Link DIR-605L getAuthCode()

IdentifiersCVE-2012-10021CWE-121· Stack-based Buffer Overflow

CVE-2012-10021 is a stack-based buffer overflow in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13. The vulnerability is in the getAuthCode() function and is triggered through the /goform/formLogin endpoint when the device processes attacker-controlled CAPTCHA data supplied via the FILECODE parameter. The flaw is caused by unsafe use of sprintf() on user-supplied input without proper bounds checking, allowing data to overflow a stack buffer. Because the vulnerable code is reachable remotely and does not require authentication, an attacker can send a crafted request to corrupt stack memory and redirect execution flow.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote unauthenticated attacker to achieve arbitrary code execution on the router with root privileges. This can result in full device compromise, including takeover of administrative control, modification of configuration, installation of persistent malware, interception or manipulation of network traffic, use of the device as a pivot point into the local network, and complete loss of confidentiality, integrity, and availability of the affected system.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the router management interface and specifically the /goform/formLogin endpoint to trusted administrative networks only. Disable remote administration from untrusted networks, place management services behind network ACLs or firewall rules, and avoid exposing the device interface to the Internet. Monitor for suspicious requests containing oversized or malformed FILECODE values. Where patching is not possible, isolate or replace the device to reduce exposure.

Remediation

Patch, then assume compromise.

Upgrade affected D-Link DIR-605L devices from firmware versions 1.12 and 1.13 to a fixed firmware release from the vendor, if available. The vulnerable code path should be corrected by replacing unsafe sprintf() usage with bounded string-handling routines and by validating and length-limiting the FILECODE input before it is copied into stack-allocated buffers. If no vendor patch is available, the affected firmware versions should be retired and the device replaced with a supported model.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

dlink_dir605l_captcha_bof.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb) targeting a remote code execution vulnerability (CVE-2012-10021) in D-Link DIR-605L routers (firmware 1.12 and 1.13). The exploit abuses a buffer overflow in the captcha handling code of the router's web interface (Boa web server) by sending a specially crafted POST request to /goform/formLogin. The module first checks for the presence of the vulnerable device by sending a GET request to /comm.asp and verifying the model and server banner. If the target is vulnerable, the exploit sends a payload (customizable MIPSBE shellcode) via the FILECODE POST parameter, resulting in arbitrary code execution as root. The module is operational and allows for custom payloads, but is ranked as 'Manual' due to limited testing environments. The code is written in Ruby and is structured as a standard Metasploit exploit module.

Disclosed Oct 8, 2012rubynetwork

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2012-10021

NVD

nvd.nist.gov/vuln/detail/CVE-2012-10021

MITRE CWE · CWE-121

Stack-based Buffer Overflow

Third Party Advisory

web.archive.org/web/20121012062554/http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow

Third Party Advisory

vulncheck.com/advisories/dlink-dir605l-captcha-handling-stack-based-buffer-overflow

Exploit

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb

Exploit

exploit-db.com/exploits/29127

Issue Tracking

forums.dlink.com/index.php?topic=51923.0

Stack-based buffer overflow in D-Link DIR-605L getAuthCode()

IdentifiersCVE-2012-10021CWE-121· Stack-based Buffer Overflow