CVE-2024-9912

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/formSetQoS. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
D-Link	DIR-619L B1	2.06
d-link	202l	2.06

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetQoS.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.280240Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.280240Third Party Advisory, VDB Entry
https://vuldb.com/?submit.418743Third Party Advisory, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Oct 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-99138.8A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the fil CVE-2024-99148.8A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the fi CVE-2024-99158.8A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ CVE-2024-99169.8A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality CVE-2024-99174.9A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-t CVE-2024-99187.2A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file a CVE-2024-99198.4A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory del CVE-2024-99208.8In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentiall CVE-2024-99219.8The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject a CVE-2024-99227.5The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploi CVE-2024-99234.9The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privil CVE-2024-99249.8The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote atta