D-Link DIR-600L CVE-2025-60570

Requires network reachability to the router's HTTP management service and the ability to send a request to the formLogDnsquery handler with an oversized curTime parameter that overflows a stack buffer (CWE-121). The CVSS vector states no privileges or user interaction are needed (PR:N/UI:N), though this auth assumption is not independently confirmed from the sources. Exploitation is limited to the specific affected build (D-Link DIR-600L firmware 1.16WWb01 / FW116WWb01), an end-of-life consumer device, and documented impact is availability loss (service crash); escalation to code execution is not established. The precise trigger beyond 'oversized curTime' is not described in the available sources.

Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, but with impact limited to availability only (C:N/I:N) - i.e. a denial-of-service against the router, not confirmed code execution, despite the CWE-121 stack-overflow classification. EPSS is low at 0.46% (40th percentile), there is no CISA KEV listing, and the vuln.today Decision label is 'this_week' rather than act_now/emergency, so this is an address-promptly item, not an active-exploitation emergency. The practical ceiling on risk is the target itself: the DIR-600L is an end-of-life consumer router, so real-world exposure depends on how many such devices remain internet-facing. Note a tension worth verifying: the input vector asserts PR:N (unauthenticated) and A:H-only, yet a stack buffer overflow in an embedded web handler can in some cases enable code execution beyond simple DoS; the available sources do not describe the trigger in enough detail to confirm an RCE outcome, so the A:H-only impact should be treated as what is documented rather than a hard upper bound.

A remote attacker who can reach the router's HTTP management interface sends a crafted request to the formLogDnsquery endpoint with an overlong curTime parameter, overflowing a stack buffer and crashing the service (availability impact). A public PoC reference exists but is not verified as working exploit code; whether the overflow can be escalated to code execution is not established in the available sources.