D-Link DIR-600L CVE-2025-60552

Exploitation requires HTTP access to the DIR-600L web management interface and the ability to submit a request to the formTcpipSetup handler with an attacker-controlled, oversized curTime parameter. The CVSS vector asserts no authentication (PR:N), but the sources do not confirm that formTcpipSetup is reachable without logging into the router admin interface - on these devices such configuration endpoints are commonly post-authentication, which would significantly limit real-world exploitation to attackers with web-UI credentials or to networks exposing the management interface. Limiting factors: DIR-600L is an end-of-life product (no vendor fix supplied), exposure is normally LAN-side unless remote management is enabled, and confirmed impact is a crash/DoS rather than confirmed code execution.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) scores a network, low-complexity, unauthenticated flaw whose only impact is availability (C:N/I:N/A:H) - i.e. NVD modeled this as a remote denial-of-service / device crash, NOT confirmed code execution, even though CWE-121 (stack-based buffer overflow) often carries RCE potential on embedded devices lacking ASLR/DEP. EPSS is low at 0.37% (31st percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; this is a prioritization signal, not an emergency. The vuln.today decision label is 'this_week', which is consistent with a HIGH-severity but not actively-exploited bug. A notable tension: CVSS reports PR:N (unauthenticated), yet formTcpipSetup is a device configuration-handling endpoint that on these D-Link SOHO routers is typically reachable only after web-UI authentication - the available sources do not confirm pre-auth reachability, so the unauthenticated assumption should be verified against the actual firmware. Net: a genuine HIGH-severity DoS in an end-of-life consumer router, but low real-world exploitation pressure (low EPSS, no KEV) and a limited blast radius given a discontinued, low-footprint product.

A remote attacker sends a crafted HTTP request to the router's web interface targeting formTcpipSetup with an oversized curTime parameter, overflowing a stack buffer and crashing the device (confirmed availability impact). A public PoC reference exists (GitHub write-up) but it is not verified as working exploit code, and whether the endpoint is reachable pre-authentication is not established in the sources. Because the attack vector is network-based with low complexity (AV:N/AC:L), exploitation is technically simple wherever the management interface is reachable.