Description

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname  leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-07T11:17:39.730Z",
  "pubdate": "2026-09-07T11:17:39.730Z",
  "executiveSummary": "A critical off-by-one memory corruption vulnerability exists within the L2TP Control Message Parser of the D-Link DIR-605 B1v202WWB03 router.\nThe vulnerability resides in the tunnel_set_params function within the progs.gpl/pppd.alpha/l2tp/tunnel.c file, specifically triggered by improper handling of the peer_hostname argument.\nThis flaw allows for remote exploitation, potentially resulting in memory corruption or arbitrary code execution depending on the state of the heap or stack surrounding the affected buffer.\nWhile the exploitation is characterized as highly complex and difficult to execute reliably, the existence of public exploit material necessitates immediate attention.\nThe impact includes potential device instability, denial-of-service (DoS) conditions, or remote code execution (RCE) by unauthorized remote attackers.\nOrganizations utilizing the affected hardware must treat this as a high-risk security event due to the potential for remote exploitation without prior authentication.",
  "technicalDetails": "The vulnerability is an off-by-one error occurring during the processing of L2TP control messages. Within the tunnel_set_params function, the application parses the peer_hostname parameter provided in incoming network traffic.\nThe root cause is an improper bounds check that fails to account for the null-terminator character or correctly size the destination buffer during string copying operations. When the peer_hostname value reaches the maximum allocated buffer length, the routine writes a single byte past the allocated memory boundary.\nThis off-by-one write can lead to the corruption of adjacent memory structures. In the context of the L2TP control parser, this often results in the modification of the least significant byte of an adjacent pointer or a control structure header. If the corruption overwrites metadata or function pointers stored in adjacent memory, it may redirect execution flow when the system subsequently references the corrupted data.\nThe attack flow originates from a remote attacker sending a crafted L2TP control packet to the device. The parser, upon processing the tunnel_set_params sequence, extracts the peer_hostname parameter. The logic utilizes a standard string copy or concatenation function that does not enforce strict length verification against the destination buffer's capacity. By supplying a string of a specific length, the attacker causes the system to write the null-terminator or an extra character into the subsequent heap chunk or stack frame.\nExploitation is categorized as highly complex because the attacker must achieve precise memory layout manipulation to ensure the corrupted byte results in a controlled outcome rather than a simple segmentation fault. The attacker must possess an understanding of the device's heap management or stack organization to influence subsequent code execution.\nBecause the L2TP component handles network communication, the vulnerability is exposed remotely. Exploitation does not require prior authentication, making it accessible to any actor capable of reaching the L2TP service on the device. Post-exploitation, an attacker could achieve arbitrary code execution at the privilege level of the l2tp process, potentially allowing for full system compromise, persistent backdoor installation, or lateral movement within the local network."
}