A stack‑based buffer overflow exists in the hedwigcgi_main function of the /cgi-bin/hedwig.cgi script on D‑Link DIR‑645 routers. Firmware versions 1.01 through 1.03 are affected. The flaw can be triggered remotely, allowing an attacker to overwrite a stack buffer and, based on typical behavior of such overflows, potentially execute arbitrary code. The consequent compromise could affect the confidentiality, integrity, and availability of the device and any network traffic it forwards.

The vulnerability impacts D‑Link DIR‑645 routers running firmware releases 1.01, 1.02, and 1.03. These devices are no longer supported by the manufacturer, meaning no official patch is currently available. As a result, the routers remain susceptible to exploitation until replaced or otherwise mitigated.

With a CVSS score of 8.7, the flaw is classified as high severity. The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote, most likely through HTTP requests targeting the /cgi-bin/hedwig.cgi endpoint. The public exploit demonstrates that attackers can launch the attack from outside the network. Consequently, any DIR‑645 device exposed to the Internet poses a significant risk, especially if no protective network segmentation or access control is applied.