Vulnerability record · CVE-2012-10021 · published 31 July 2025

CVE-2012-10021: Dlink dir-605l firmware stack-based buffer overflow vulnerability

Dlink · Dir 605l Firmware

A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device.

9.3 CVSS 4.0 Critical EPSS 4.4% · top 9.0% CWE-121 · Stack-based buffer overflow

9.3CVSS 4.0 base score

4.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References, 3 tagged exploit

16 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Dir 605l Firmware Dlink

References

Link	Tags
https://forums.dlink.com/index.php?topic=51923.0	Issue Tracking
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir605l_captcha_b	Exploit
https://web.archive.org/web/20121012062554/http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/	ExploitThird Party Advisory
https://www.exploit-db.com/exploits/29127	Exploit
https://www.vulncheck.com/advisories/dlink-dir605l-captcha-handling-stack-based-buffer-overflow	Third Party Advisory

Track CVE-2012-10021 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2014-8361Realtek SDK miniigd SOAP service remote code executionThe miniigd SOAP service in the Realtek SDK fails to properly validate input in a NewInternalClient request, allowing remote code execution. The flaw…KEVEPSS 100%analysed1 May 2015 7.5CVE-2021-40655D-Link DIR-605 router credential disclosure via getcfg.phpD-Link DIR-605 B2 firmware 2.01MT exposes credentials through the /getcfg.php page, which fails to enforce proper authorization. A crafted POST reque…KEVEPSS 87%analysed24 Sep 2021 9.8CVE-2023-29961Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,EPSS 1.2%16 May 2023 9.8CVE-2023-24348Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.EPSS 1.2%10 Feb 2023 9.8CVE-2023-24349Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.EPSS 1.2%10 Feb 2023 9.8CVE-2023-24350Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform/formSetE…EPSS 1.2%10 Feb 2023 9.8CVE-2023-24351Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.EPSS 1.2%10 Feb 2023 9.8CVE-2023-24352Dlink dir-605l firmware out-of-bounds write vulnerabilityD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS.EPSS 1.2%10 Feb 2023

Source: NIST National Vulnerability Database (record CVE-2012-10021), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.