CVE-2026-5815
Stack-Based Buffer Overflow in D-Link DIR-645 hedwigcgi_main
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| d-link | dir-645 | to 1.03 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-5815 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-5815 is a critical stack-based buffer overflow vulnerability found in the hedwig.cgi component of the D-Link DIR-645 router firmware versions up to 1.03.
The vulnerability exists in the function hedwigcgi_main, which processes HTTP requests and handles a user session identifier (Session UID). This function uses a fixed-size stack buffer of 1024 bytes for string concatenation without checking the length of the input.
An attacker can supply an excessively long Session UID, causing a buffer overflow that overwrites adjacent stack memory, including the return address. This allows the attacker to hijack the program's control flow and execute arbitrary code remotely.
Exploitation involves crafting a payload that overwrites the return address and injects MIPS shellcode, which can spawn an interactive shell on the device, leading to full device compromise.
How can this vulnerability impact me? :
This vulnerability allows a remote attacker to execute arbitrary code on the affected D-Link DIR-645 router, potentially gaining full control over the device.
With full device compromise, the attacker can manipulate network traffic, intercept sensitive data, disrupt network services, or use the router as a foothold for further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the /cgi-bin/hedwig.cgi endpoint on D-Link DIR-645 routers running firmware versions up to 1.03. Specifically, look for unusually long or suspicious Session UID values in the HTTP cookie headers, as these are used to trigger the stack-based buffer overflow.
A practical detection method involves capturing HTTP traffic and inspecting the cookie headers for abnormally long Session UID strings that exceed typical lengths.
Example commands to detect suspicious requests might include:
- Using tcpdump to capture HTTP traffic on the router's interface: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
- Using grep or similar tools to filter captured traffic for the /cgi-bin/hedwig.cgi path and look for long Session UID cookie values.
- Example: grep 'Cookie:.*SessionUID=' captured_traffic.txt | awk '{print length, $0}' | sort -nr | head
Additionally, reviewing router logs for abnormal crashes or reboots related to the hedwig.cgi process may indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /cgi-bin/hedwig.cgi endpoint to trusted networks only, such as by implementing firewall rules that block external HTTP requests to this path.
Since the affected D-Link DIR-645 firmware versions up to 1.03 are no longer supported by the maintainer, no official patches are available.
Additional mitigation measures include disabling remote management features on the router if possible, and monitoring network traffic for exploitation attempts.
Ultimately, replacing the affected device with a newer, supported model is recommended to fully eliminate the risk.