Dir 619l Firmware CVE-2025-6367

Despite the CVSS 3.1 score of 8.8 (High), real-world risk must be contextualized: (1) The attack requires authentication (PR:L), reducing opportunistic attack surface—attackers must first compromise credentials or exploit separate authentication bypasses. (2) CVSS vector shows network accessibility (AV:N) with low complexity (AC:L), indicating straightforward exploitation mechanics once authenticated. (3) Public exploit disclosure increases risk substantially; threat actors have functional attack code. (4) The device is end-of-life with no vendor support, meaning no patches are forthcoming—this is a permanent vulnerability for deployed installations. (5) D-Link DIR-619L is legacy hardware (last supported ~2015); it likely has reduced deployment in modern networks, but may persist in older installations, remote offices, or as secondary equipment. (6) Stack-based buffer overflows with code execution typically rank HIGH priority in SSVC framework given technical impact (code execution) and automatable exploitation (POC public). However, the authentication requirement and device obsolescence suggest this is HIGH priority for legacy environments but MEDIUM-LOW for organizations with modern equipment refresh cycles. Organizations with DIR-619L routers in production should treat this as immediate risk requiring isolation or replacement.

An attacker with network access to the router's administrative interface (obtained through credential compromise, default credentials, or phishing) initiates an HTTP POST request to /goform/formSetDomainFilter. The attacker crafts malicious input for the url_%d parameter containing a carefully constructed payload (e.g., 2000+ bytes) that overflows the stack buffer allocated for URL storage. The overflow overwrites the return address on the stack, redirecting code execution to attacker-controlled shellcode. The attacker achieves remote code execution with root privileges (typical for embedded device processes), allowing them to modify firewall rules, extract credentials, pivot to internal networks, or establish persistent backdoors. Since public exploits are available, this attack is highly automatable and requires minimal sophistication. The authentication requirement means the attack typically follows initial compromise of credentials or discovery of default credentials (DIR-619L has documented default credentials in public databases).