D-Link DIR-600L CVE-2025-60553

Exploitation requires network access to the DIR-600L HTTP management interface and the ability to invoke the formSetWAN_Wizard52 handler with an oversized value in the curTime parameter. Limiting factors: the device must be reachable on the network - by default this is the LAN, so internet-facing exploitation generally depends on remote management (WAN admin) being enabled or the attacker having a LAN foothold; the sources do not confirm whether an authenticated admin session is required, even though this handler is part of the web WAN-setup wizard that typically sits behind authentication. The precise trigger (field length, encoding) is not described in the available sources. DIR-600L is a legacy/end-of-life product, which further limits the realistic exploitable population.

Signals conflict and must be weighed together rather than read off the headline score. The CVSS base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N, which on its face describes a remote, unauthenticated, low-complexity memory-corruption flaw - the kind of profile that normally justifies emergency patching. However, EPSS is only 0.41% (35th percentile), indicating a low modeled probability of exploitation in the near term, and the vulnerability is NOT listed in CISA KEV, so there is no confirmation of active, widespread exploitation. The vuln.today decision label is act_now, which is driven largely by the critical CVSS plus the existence of a public write-up rather than by observed in-the-wild activity. A public PoC reference exists on GitHub; it is not verified as working exploit code, so PoC availability should not be conflated with active exploitation. There is also a plausible vector/mechanism tension: the scored vector asserts PR:N (unauthenticated), yet formSetWAN_Wizard52 is a WAN-setup wizard handler in the router's web management interface, which on most D-Link devices sits behind an admin session - the sources do not state whether authentication is actually required, so the PR:N assertion should be verified against the device's actual access control. Net assessment: this is a genuinely serious memory-corruption flaw in principle, but real-world priority is tempered by low EPSS, no KEV listing, an unverified PoC, and a niche, largely end-of-life consumer router footprint. Treat it as high priority for anyone still running DIR-600L (especially with remote management exposed), but not an indication of mass exploitation.

An attacker able to reach the DIR-600L web management interface submits a request to the formSetWAN_Wizard52 handler with an oversized curTime parameter, overflowing a buffer (CWE-120) in the firmware's request handling. On these embedded MIPS routers this can crash the device or potentially lead to code execution in the web server's context. A public PoC reference exists on GitHub, but it is not verified as working exploit code, and the sources do not describe how the overflow is triggered in detail.