Remote Code Execution Vulnerability in D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow

CVE-2024-5293

What is CVE-2024-5293?

The D-Link DIR-2640 router is susceptible to a stack-based buffer overflow vulnerability, which allows remote code execution by network-adjacent attackers without requiring authentication. The flaw lies in the handling of HNAP requests within the prog.cgi script, part of the lighttpd webserver. Insufficient validation of user-supplied data enables an attacker to exceed the bounds of a fixed-length stack buffer, leading to the potential execution of arbitrary code in the root context. Organizations using the D-Link DIR-2640 routers should urgently review their systems and apply the necessary security patches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References