A buffer overflow exists in the formVirtualServ handler of the DIR‑605L’s web interface. By sending a malicious POST request that exploits the curTime argument, an attacker can overwrite adjacent memory and trigger arbitrary code execution. The flaw is a classic buffer copy without bounds checks (CWE‑119) and buffer over‑write (CWE‑120), allowing complete control of the device.

The vulnerability only affects the D‑Link DIR‑605L model running firmware 2.13B01. This generation is no longer supported by the vendor, meaning no official security updates are available for the exposed platforms.

The CVSS assessment of 8.7 places the issue in the high‑severity category, and documented public exploits demonstrate that the attack can be carried out remotely without authentication. While EPSS data is not provided, the confirmed exploitability and lack of vendor support significantly increase the risk of exploitation. The flaw is not listed in the CISA KEV catalog, but the combination of public exploitation and unsupported hardware makes immediate action critical.