Dir 619l Firmware CVE-2025-6114

Despite the 8.8 CVSS score indicating high severity, real-world risk is substantially elevated by multiple factors: (1) Public exploit availability removes the exploitation barrier; (2) Authentication requirement (PR:L) suggests moderate barrier but is standard for router admin interfaces often accessible via default credentials or prior compromise; (3) The product is end-of-life with no vendor support, meaning no security patches will ever be released; (4) Legacy router deployments commonly remain in production for years post-EOL, creating persistent vulnerable populations; (5) Network-accessible management interfaces (AV:N) enable remote exploitation without physical access. CVSS vector analysis shows complete system compromise possible (C:H/I:H/A:H). The combination of public POC, authentication bypass vectors in legacy routers, and absence of remediation paths makes this a high-priority vulnerability for organizations with DIR-619L deployments despite the EOL status. SSVC assessment: Exploitation = observed (POC public), Automatable = likely (buffer overflow exploits often automatable), Technical Impact = total loss of confidentiality/integrity/availability. This escalates priority beyond CVSS score alone.

An attacker targets an organization with legacy D-Link DIR-619L routers still in production service. The attacker first gains authenticated access by exploiting default credentials (common in unmanaged legacy equipment) or by leveraging prior network compromise granting access to the router's management interface. The attacker then crafts HTTP POST requests to /goform/form_portforwarding with oversized payloads in the ingress_name_%d parameter (e.g., extremely long port forwarding rule names exceeding buffer boundaries). The stack-based buffer overflow allows the attacker to overwrite the function return address with shellcode address. Upon function return, the injected shellcode executes with the web server process privileges, allowing remote code execution. The attacker can then establish persistent access, modify router configuration, intercept network traffic, or use the compromised router as a pivot point for lateral network movement. With public POC tools available, this exploit requires minimal technical sophistication and can be rapidly weaponized at scale against vulnerable DIR-619L deployments, particularly those with internet-exposed management interfaces.