CVE-2024-27619 describes a buffer overflow vulnerability in the FTP server of Dlink Dir-3040us A1 1.20b03a hotfix firmware. The vulnerability arises when a user with read/write FTP access uploads files larger than the available RAM, causing the RAM to fill and resulting in buffer overflow and system resource exhaustion. The FTP server permits changing directories to the root, which is one level above the USB flash directory root, facilitating this condition. The exhaustion of system memory causes the device to crash and reboot, impacting availability. The CVSS 3.1 base score is 7.3, reflecting high severity with network attack vector requiring low privileges and no user interaction, causing high impact on integrity and availability.

Exploitation of this vulnerability can cause denial of service through system crashes and reboots due to buffer overflow and memory exhaustion. While confidentiality is not impacted, integrity and availability are severely affected. Attackers with read/write FTP access can trigger this condition by uploading large files, potentially disrupting device operation and network services relying on the device.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict FTP access to trusted users only and monitor for unusual FTP activity involving large file uploads. Consider disabling the FTP server if not required to prevent exploitation.