D-Link DIR-2640 1.11B02_BETA02 lighttpd Webserver prog.cgi stack-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in D-Link DIR-2640 1.11B02_BETA02. Affected is an unknown function of the file prog.cgi of the component lighttpd Webserver. The manipulation results in stack-based overflow. This vulnerability is known as CVE-2024-5293. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in D-Link DIR-2640 1.11B02_BETA02. It has been classified as very critical. Affected is some unknown functionality of the file prog.cgi of the component lighttpd Webserver. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21853.

The advisory is shared for download at zerodayinitiative.com. This vulnerability is traded as CVE-2024-5293 since 05/23/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/06/2025).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-2640

Version

• 1.11B02_BETA02

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion