What is the CVSS score of CVE-2025-6115?

CVE-2025-6115 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6115?

D-Link DIR-619L routers (version 2.06B01 and earlier) contain a critical remote code execution vulnerability with a public exploit available.

Is there a public PoC exploit available for CVE-2025-6115?

Yes, a public proof-of-concept exploit is available for CVE-2025-6115. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6115?

Within 24 hours: Identify and inventory all DIR-619L devices in production and DMZ environments; assess criticality and exposure to untrusted networks. Within 7 days: Implement network segmentation to restrict access to affected devices; disable web management interfaces if operationally feasible; deploy WAF rules blocking requests to vulnerable functions (form_macfilter, mac_hostname, sched_name parameters). Within 30 days: Replace DIR-619L units with supported, current-generation equipment; decommission unsupported hardware from production environments.

Dir 619l Firmware CVE-2025-6115

EUVD-2025-18372 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

RCE Buffer Overflow D-Link Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18372

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Jun 17, 2025 - 20:32 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The manipulation of the argument mac_hostname_%d/sched_name_%d leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Critical stack-based buffer overflow vulnerability in D-Link DIR-619L version 2.06B01 affecting the form_macfilter function through improper handling of mac_hostname_%d and sched_name_%d parameters. An authenticated remote attacker can exploit this vulnerability to achieve complete system compromise including confidentiality, integrity, and availability impacts (CVSS 8.8). Public exploit code is available and the product is end-of-life, significantly elevating real-world risk.

Technical ContextAI

The vulnerability exists in the web management interface of the D-Link DIR-619L wireless router (CPE: cpe:2.3:h:d-link:dir-619l:2.06b01:*:*:*:*:*:*:*). The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow occurring when user-supplied input to the form_macfilter function parameters (mac_hostname_%d and sched_name_%d) is not properly validated before being written to stack memory. These parameters likely relate to MAC address filtering and scheduler name configuration features. Without bounds checking, an attacker can overflow the stack buffer, overwriting return addresses and other critical stack data. The vulnerability requires authentication (PR:L in CVSS vector), indicating the attacker must have valid credentials or the router's default authentication must be bypassed—a common scenario with consumer routers using default credentials.

RemediationAI

No vendor patches are available due to end-of-life product status. Recommended remediation options in priority order: (1) Retire the affected device—Replace DIR-619L with a currently supported router model receiving active security updates; (2) Network segmentation—If replacement is not immediately possible, isolate the router to a restricted management VLAN accessible only to trusted administrators, disable remote management features (HTTPS admin interface), and restrict access to the web interface to specific internal IP addresses via firewall rules; (3) Credential hardening—Change default admin credentials to a strong, unique password; disable WPS; (4) Monitor for exploitation—Monitor router logs for suspicious web interface access attempts, unusual process execution, or memory dumps; (5) Avoid untrusted networks—Do not expose the router to untrusted network segments or the public internet. No workarounds can fully mitigate a stack buffer overflow vulnerability in firmware code without patching.