D-Link DIR-2640 prog.cgi Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability

Vulnerability

The vulnerability resides in the prog.cgi binary of the D-Link DIR-2640 router web management interface, which listens on TCP port 80 by default. A stack-based buffer overflow occurs because the program copies user-supplied data into a fixed-size stack buffer without proper length validation. Affected firmware versions are v1.11B02, v1.11B02 Beta01, and all earlier releases for hardware revision Ax [1][2].

Exploitation

An attacker must be network-adjacent (i.e., on the same local network segment) to reach the web interface. No authentication is required. The attacker sends a crafted HTTP request to the prog.cgi endpoint containing data that exceeds the allocated buffer length, triggering the overflow and allowing overwrite of the return address or other critical stack data [2].

Impact

Successful exploitation grants arbitrary code execution in the context of the root user. This provides full administrative control over the router, enabling the attacker to intercept, modify, or redirect network traffic, install persistent malware, or use the device as a pivot for further attacks [2].

Mitigation

D-Link has released firmware version v1.11B02_Beta_Hotf… (exact hotfix name not fully disclosed) as a fix for this vulnerability [1]. Users are advised to update to the latest firmware available from the D-Link support website. If the device is no longer supported or an update cannot be applied, consider replacing the router or isolating it from untrusted network segments. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.