What is the CVSS score of CVE-2025-6114?

CVE-2025-6114 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6114?

D-Link DIR-619L routers (version 2.06B01) contain a critical stack-based buffer overflow vulnerability that allows remote attackers to compromise affected devices without authentication.

Is there a public PoC exploit available for CVE-2025-6114?

Yes, a public proof-of-concept exploit is available for CVE-2025-6114. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6114?

Within 24 hours: Inventory all DIR-619L 2.06B01 devices in your environment and isolate any connected to production networks. Within 7 days: Evaluate replacement options or decommissioning of affected routers, as vendor support has ended and no patch will be released. Within 30 days: Complete replacement or decommissioning of all vulnerable devices and validate network perimeter security.

Dir 619l Firmware CVE-2025-6114

EUVD-2025-18370 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

Buffer Overflow D-Link RCE Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18370

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Jun 17, 2025 - 20:32 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the file /goform/form_portforwarding. The manipulation of the argument ingress_name_%d/sched_name_%d/name_%d leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01, affecting the port forwarding configuration function. An authenticated remote attacker can exploit this vulnerability by manipulating the ingress_name_%d, sched_name_%d, or name_%d parameters to achieve remote code execution with high integrity and confidentiality impact. The vulnerability has public exploit code available and affects only end-of-life products no longer receiving vendor support, significantly elevating real-world risk for exposed legacy deployments.

Technical ContextAI

The vulnerability exists in the /goform/form_portforwarding endpoint within D-Link DIR-619L wireless routers (CPE: cpe:2.3:o:d-link:dir-619l_firmware:2.06b01:*:*:*:*:*:*:*). The affected function form_portforwarding improperly handles user-supplied input for port forwarding configuration parameters without adequate bounds checking. This constitutes a CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) classic stack-based buffer overflow. The vulnerability allows attackers to write arbitrary data beyond allocated stack buffers, potentially overwriting return addresses and other critical stack structures. The web interface processing of form parameters creates the attack surface, with input validation failures enabling the overflow condition.

RemediationAI

Primary remediation option: Discontinue use of D-Link DIR-619L routers and replace with supported, current-generation networking equipment, as D-Link will not provide security patches for EOL products. Immediate mitigation strategies for organizations unable to immediately replace hardware: (1) Disable remote management access - restrict /goform/form_portforwarding web interface access to local network only via firewall rules; (2) Implement network segmentation - place affected routers on isolated management VLANs with restricted access; (3) Change default credentials immediately and enforce strong authentication if web interface must remain accessible; (4) Monitor network traffic for exploitation attempts targeting the /goform/form_portforwarding endpoint; (5) Deploy intrusion detection rules to identify malformed portforwarding parameters. No official vendor patches exist or will be released. Community-developed firmware replacements (OpenWrt, DD-WRT) may provide alternative solutions if available for this hardware revision, though validation and testing required. Hardware replacement remains the preferred remediation path.