D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability

Vulnerability

A stack-based buffer overflow vulnerability exists in the prog.cgi component of the D-Link DIR-2640-US router, which handles HNAP requests processed by the lighttpd web server on TCP ports 80 and 443. The flaw stems from improper validation of the length of user-supplied data in the HTTP Referer header before copying it to a fixed-length stack buffer [1]. All firmware versions of the DIR-2640 are affected [1].

Exploitation

An unauthenticated attacker on the same network as the target router can exploit this vulnerability by sending a specially crafted HTTP HNAP request with an oversized Referer header value [1]. No authentication or prior access is required. The attacker does not need any user interaction [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with root privileges on the affected router [1]. This gives the attacker full control over the device, enabling them to compromise network traffic, install malware, or pivot to other systems on the network [1].

Mitigation

The vendor, D-Link, has not released a patch or advisory for this vulnerability. The affected DIR-2640 model is end-of-life and no longer supported [1]. The only recommended mitigation is to replace the router with a supported model that receives security updates [1].