CVE-2024-5293

D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21853.

• CWE-121

• https://www.zerodayinitiative.com/advisories/ZDI-24-444/Third Party Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-24-444/Third Party Advisory

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52922In Bitcoin Core before 25.1, an attacker can cause a node to…6.5
• CVE-2024-52923An issue was discovered in NRMM in Samsung Mobile Processor,…7.5
• CVE-2024-52924An issue was discovered in NRMM in Samsung Mobile Processor,…7.5
• CVE-2024-52925In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code ex…6.8
• CVE-2024-52926Delinea Privilege Manager before 12.0.2 mishandles the secur…6.5
• CVE-2024-52928Arc before 1.26.1 on Windows has a bypass issue in the site …8.3
• CVE-2024-52935Kernel software installed and running inside a Guest VM may …4.1
• CVE-2024-52936Kernel software installed and running inside a Guest VM may …4.4
• CVE-2024-52937Kernel software installed and running inside a Guest VM may …6.7
• CVE-2024-52938Kernel software installed and running inside a Guest VM may …7.8
• CVE-2024-52939Kernel software installed and running inside a Guest VM may …7.8
• CVE-2024-5294D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Den…6.5