Executive brief
A vulnerability exists in certain older D-Link home routers that allows an attacker to take full control of the device remotely. By sending a specially crafted web request, an attacker can crash the system or execute malicious code. This could lead to the theft of network traffic, unauthorized access to connected devices, or the router being used in a botnet. Note that these devices are no longer supported by the manufacturer and will not receive security updates.
Technical details
A stack-based buffer overflow vulnerability exists in the hedwigcgi_main function within /cgi-bin/hedwig.cgi on D-Link DIR-645 routers (firmware versions 1.01 through 1.03). The issue stems from the unsafe use of the sprintf function when processing the Session UID (uid) from HTTP cookies. The application fails to validate the length of the user-supplied UID before concatenating it into a fixed-size 1024-byte stack buffer. A remote attacker with low privileges can provide an excessively long UID string to overwrite the stack, hijack the program's execution flow (specifically the $ra register on MIPS architecture), and achieve remote code execution (RCE). A public proof-of-concept exploit is available. As the product is end-of-life, no official patch is expected.
Affected products
- D-Link DIR-645 1.01, 1.02, 1.03
Timeline
- 2026-04-09: advisory: Initial disclosure date
- 2026-04-09: disclosed: Public exploit code made available on GitHub
References
- https://github.com/Pers1st0/CVE/blob/main/stack-based%20buffer%20overflow%20vulnerability%20exists%20in%20the%20hedwig.cgi%20of%20D-Link%20DIR-645.md
- https://github.com/Pers1st0/CVE/blob/main/stack-based%20buffer%20overflow%20vulnerability%20exists%20in%20the%20hedwig.cgi%20of%20D-Link%20DIR-645.md
- https://vuldb.com/submit/788298
- https://vuldb.com/vuln/356263
- https://vuldb.com/vuln/356263/cti
- https://www.dlink.com/