CVE-2012-10021

A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device.

• CWE-121

• https://forums.dlink.com/index.php?topic=51923.0Issue Tracking
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rbExploit
• https://web.archive.org/web/20121012062554/http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/29127Exploit
• https://www.vulncheck.com/advisories/dlink-dir605l-captcha-handling-stack-based-buffer-overflowThird Party Advisory

Published

Jul 31, 2025

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10016A vulnerability classified as problematic has been found in …7.5
• CVE-2012-10017A vulnerability was found in BestWebSoft Portfolio Plugin up…8.8
• CVE-2012-10018The Mapplic and Mapplic Lite plugins for WordPress are vulne…8.3
• CVE-2012-10019The Front End Editor plugin for WordPress is vulnerable to a…9.8
• CVE-2012-1002SQL injection vulnerability in author/edit.php in OpenConf 4…
• CVE-2012-10020The FoxyPress plugin for WordPress is vulnerable to arbitrar…9.8
• CVE-2012-10022Kloxo versions 6.1.12 and earlier contain two setuid root bi…8.5
• CVE-2012-10023A stack-based buffer overflow vulnerability exists in FreeFl…9.8
• CVE-2012-10024XBMC version 11.0 contains a path traversal vulnerability in…7.1
• CVE-2012-10025The WordPress plugin Advanced Custom Fields (ACF) version 3.…10
• CVE-2012-10026The WordPress plugin Asset-Manager version 2.0 and below con…10
• CVE-2012-10027WP-Property plugin for WordPress up to and including version…9.3