What is the CVSS score of CVE-2025-60549?

CVE-2025-60549 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-60549?

Within 24 hours, inventory all D-Link DIR-600L Ax devices on corporate, branch, or remote-worker networks and confirm firmware versions, treating any unit at 1.16WWb01 as exposed. Within 7 days, isolate affected units to dedicated network segments or dedicated VLANs with management access restricted to trusted administrative hosts, and block inbound access to the formAutoDetecWAN_wizard4 endpoint from untrusted networks. Within 30 days, plan replacement of these end-of-life consumer routers with supported enterprise-grade equipment, since no vendor patch is available, and document a retirement timeline for the remainder.

D-Link DIR-600L CVE-2025-60549

HIGH

Stack-based Buffer Overflow (CWE-121)

2025-10-24 cve@mitre.org

Buffer Overflow D-Link Stack Overflow Dir 600L Firmware

7.5

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router HTTP interface
Exploit

Send request with oversized curTime
Execution

Overflow stack buffer in formAutoDetecWAN_wizard4
Impact

Crash web service / device (DoS)

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires network access to the administrative HTTP interface of a D-Link DIR-600L running firmware 1.16WWb01 and the ability to invoke the formAutoDetecWAN_wizard4 (WAN auto-detect wizard) handler with an attacker-controlled curTime parameter. The CVSS vector indicates no authentication or user interaction (PR:N/UI:N), but no vendor advisory confirms whether the endpoint is pre- or post-authentication, so the auth requirement is not independently verified. Real-world exposure is limited by the fact that router management interfaces are typically LAN-facing by default (WAN-side reachability depends on remote-management being enabled) and by the product being an end-of-life consumer device; the available sources do not describe the precise overflow trigger beyond the vulnerable parameter and function.
Impact	Signals point to a genuine but low-to-moderate priority issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is availability (C:N/I:N) - i.e. a denial-of-service/crash of the router's web service or device, not confirmed code execution or data exposure. This is notable because CWE-121 (stack-based buffer overflow) frequently enables remote code execution on these D-Link CGI endpoints, yet the assigned vector claims availability-only impact; that gap is unresolved in the available data and should be verified. EPSS is low (0.37%, 31st percentile) and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week', consistent with a real but non-emergency fix cadence. A public GitHub write-up (luckysmallbird) and a VulDB advisory exist, raising the practical exploitability of a DoS above a purely theoretical bug, but neither is confirmed as working weaponized exploit code. Net: treat as a routine patch/mitigation item for affected DIR-600L devices, not a drop-everything incident.
Exploit ScenarioDerived	A remote attacker with network reachability to the router's HTTP management interface sends a crafted request to the formAutoDetecWAN_wizard4 handler with an oversized curTime parameter, overflowing a stack buffer and crashing the web service or device (denial of service per the A:H-only CVSS vector). A public PoC reference exists (GitHub write-up) but is not verified as working exploit code, and whether the overflow can be escalated to code execution is not established in the available sources. No user interaction or authentication is indicated by the CVSS vector (PR:N/UI:N).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

A stack-based buffer overflow in the D-Link DIR-600L Ax consumer router (firmware 1.16WWb01) lets remote attackers crash or destabilize the device by supplying an oversized curTime parameter to the formAutoDetecWAN_wizard4 WAN auto-detect wizard handler. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) rates it 7.5 because impact is scored as availability-only, though no vendor advisory in the available sources confirms whether that endpoint is reachable before or after authentication. Exploitation is not confirmed in the wild (not in CISA KEV) and EPSS is low at 0.37% (31st percentile); a public PoC reference exists in a GitHub write-up, it is not verified as working exploit code. Practical exposure is constrained because the management interface is normally LAN-facing and the product is an end-of-life consumer device.

RemediationAI

No vendor-released patch was identified in the available sources for CVE-2025-60549, and the DIR-600L is an end-of-life consumer router, so replacement with a supported device is the only complete fix. Until then, the actionable compensating control is to remove reachability to the administrative HTTP interface: keep the router's web UI bound to the LAN side and ensure WAN-side remote management is disabled, since the exploitation condition is network access to that administrative interface - the trade-off is that you lose the ability to administer the device from outside the LAN. Where the wizard endpoint is not needed, restrict access to it at the network layer (for example, firewall rules limiting port 80/443 on the router to a small set of trusted management hosts), accepting that any host still on that allow-list retains the ability to trigger the overflow. Because the sources do not confirm whether formAutoDetecWAN_wizard4 is pre- or post-authentication, do not treat credentials or a login gate as a mitigation without independent verification; monitor the device for unexpected reboots or web-UI unavailability as an indicator of overflow attempts. Reference material is at https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/05-buffer%20overflow-formAutoDetecWAN_wizard4.md and https://vuldb.com/vuln/329807.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is classified CWE-121, stack-based buffer overflow, which means a fixed-size stack buffer in the firmware's HTTP request handling code is filled past its bounds before any length validation occurs. The affected component is the web-based administrative interface of the DIR-600L Ax firmware build 1.16WWb01 (CPE cpe:2.3:o:dlink:dir-600l_firmware:1.16wwb01), specifically the formAutoDetecWAN_wizard4 function that implements the WAN auto-detection wizard, where the curTime request parameter is copied into that stack buffer. The available sources identify the vulnerable parameter and function but do not describe the precise trigger, the buffer size, or the byte layout required for control-flow hijacking, so the overflow's exploitability beyond denial of service is unverified. The assessed impact is availability-only (C:N/I:N/A:H), consistent with a memory-corruption crash path in an embedded MIPS-class router binary that typically ships without stack canaries or ASLR hardening, though no source confirms the exact mitigations compiled into this image.

Know when Dir 600L Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Network-reachable web handler with a controllable overflow parameter and no stated auth (AV:N/AC:L/PR:N/UI:N); impact scored as availability-only (A:H) matching the evidence, with code execution unconfirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4.

Executive ViewAI

Why It Matters

A high-severity flaw in the end-of-life D-Link DIR-600L Ax home router (firmware 1.16WWb01) allows a remote attacker to crash or destabilize the device via an oversized parameter in its WAN auto-detect handler. Practical risk to the organization is limited because this is a consumer-grade, end-of-life unit whose management interface is typically LAN-facing, and no exploitation has been confirmed. Leadership should care mainly if these devices sit on corporate or branch networks, where an outage could disrupt connectivity for staff at that location.

Business Impact: Low

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: segment affected routers onto isolated VLANs, restrict management interface access to trusted LAN hosts only, block external access to the WAN auto-detect wizard endpoint, monitor for device reboots or instability indicating attempted abuse, and accelerate replacement of the end-of-life device.

Threat Intelligence Overview

EPSS Score

0.4%

Top 69% exploitable

Prevalence

Low

EOL D-Link consumer router, niche footprint, minimal enterprise presence

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.