CVE-2026-5983

BRIEFING NOTE: CVE-2026-5983 A buffer overflow vulnerability has been identified in D-Link DIR-605L firmware version 2.13B01, specifically within the formSetDDNS POST request handler function. The vulnerability is triggered through manipulation of the curTime argument and affects only end-of-life products no longer receiving vendor support. The vulnerability carries a high CVSS score of 8.8, exploitable remotely by authenticated users with low attack complexity. Successful exploitation could result in complete system compromise, including confidentiality breach, integrity violation, and service disruption. The attack requires valid credentials but no user interaction. While exploit code has been publicly disclosed, this vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. Given the EPSS score of 0.0005 and the target being legacy unsupported hardware, real-world risk is minimal. Organizations should nevertheless apply mitigations if DIR-605L devices remain in their environments, as public exploit availability presents a theoretical attack surface.