CVE-2012-10021: Critical Stack Overflow in D-Link DIR-605L

CVE-2012-10021 is a critical (CVSS 9.8) stack-based buffer overflow in D-Link DIR-605L Wireless N300 Cloud Router firmware 1.12 and 1.13. Unsafe handling of the CAPTCHA FILECODE value at the login form lets an unauthenticated remote user run code as root. Check D-Link's support site for fixed firmware.

What's affected

D-Link DIR-605L firmware versions 1.12 and 1.13, per the record. VulnCheck notes that the affected version range and models are not fully defined, so other firmware revisions of the same family may also be affected.

The record identifies the function getAuthCode and an unsafe use of sprintf when processing the FILECODE parameter in the login form handler. I could not confirm a fixed firmware number from the pages available, so check the D-Link support page for your exact hardware revision and confirm the device still receives updates.

How to check if you're exposed

Log in to the router's admin page and read the firmware version on the status screen. A DIR-605L on 1.12 or 1.13 is in scope.

Then find out whether the management interface is reachable from outside. From a machine outside your network, a port check against the router's WAN address shows whether the web interface is listening:

nmap -p 80,8080,443 <router-wan-address>

Only test addresses you own. If the interface answers from the internet, remote management is enabled and should be turned off unless you have a specific need.

Also check the vendor's support page for the model's status. If the model is end of life, no firmware fix may arrive.

What to do now

1. Read the firmware version from the router admin page.
2. Check the D-Link support page for your exact hardware revision, and install fixed firmware if one exists.
3. Turn off remote management so the login handler is not reachable from the internet.
4. If the model is end of life and no fix exists, replace the router.
5. After any suspected exposure, change the admin password and review DNS and port forwarding settings on the device.

Why it matters

The weakness is CWE-121 (Stack-based Buffer Overflow). A routine that builds a string with sprintf copies attacker-supplied data into a fixed buffer without checking its size. Because it runs in the login flow, no credentials are needed to reach it, and a successful overflow runs code as root on the router.

Routers are attractive because they sit at the edge of the network and almost never get monitored. A compromised one can redirect traffic, expose internal hosts or join a botnet. The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is listed among the references.

For small offices, the practical advice is dull but effective: know which models you run, know when they leave support, and keep the admin page off the internet.

Quick check

Sources

• VulnCheck advisory
• Gold vulnerability page

Last reviewed: 19 October 2026.