What is the CVSS score of CVE-2025-6367?

CVE-2025-6367 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6367?

A critical stack-based buffer overflow vulnerability (CVE-2025-6367) affects D-Link DIR-619L routers (version 2.06B01) with a public exploit available.

Is there a public PoC exploit available for CVE-2025-6367?

Yes, a public proof-of-concept exploit is available for CVE-2025-6367. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6367?

Within 24 hours: Inventory all D-Link DIR-619L devices in production and isolate any identified units from trusted networks or place behind additional security controls. Within 7 days: Develop a device replacement plan prioritizing internet-facing and critical network access points; implement network segmentation to limit lateral movement if compromise occurs. Within 30 days: Complete replacement of all affected DIR-619L units with supported, current-generation network equipment and conduct security audit of potentially compromised systems.

Dir 619l Firmware CVE-2025-6367

EUVD-2025-18788 HIGH

Buffer Overflow (CWE-119)

2025-06-20 cna@vuldb.com

Buffer Overflow D-Link RCE Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18788

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 25, 2025 - 20:07 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in D-Link DIR-619L 2.06B01. It has been declared as critical. This vulnerability affects unknown code of the file /goform/formSetDomainFilter. The manipulation of the argument curTime/sched_name_%d/url_%d leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

CVE-2025-6367 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01, affecting the /goform/formSetDomainFilter endpoint. An authenticated remote attacker can exploit improper input validation on the curTime, sched_name_%d, and url_%d parameters to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability). The vulnerability has public exploit disclosure and affects end-of-life hardware no longer receiving vendor support.

Technical ContextAI

The vulnerability exists in the web management interface of D-Link DIR-619L wireless routers (CPE: cpe:2.3:h:d-link:dir-619l:-). The affected code path is the /goform/formSetDomainFilter form handler, which processes domain filtering configuration. The root cause is a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that user-supplied input to parameters like curTime, sched_name_%d, and url_%d is copied into fixed-size stack buffers without proper bounds checking. This is a classic memory safety issue common in embedded device firmware written in C/C++. The vulnerability requires authentication (PR:L) to trigger, suggesting it exists in an administrative interface but may be accessible to low-privilege authenticated users.

RemediationAI

action: Replace or retire affected hardware; details: Since D-Link DIR-619L is end-of-life with no vendor patches available, the only reliable remediation is hardware replacement with a currently supported router model. Firmware downgrades are not a viable mitigation.
action: Network isolation and access controls; details: If replacement is not immediately possible: (1) Restrict access to the web management interface (port 80/443) to trusted administrative networks only using firewall ACLs. (2) Disable remote management features entirely. (3) Change default credentials and use strong, unique passwords. (4) Isolate the device to a separate management VLAN with restricted egress.
action: Monitor for exploitation attempts; details: Enable logging on upstream security devices to detect POST requests to /goform/formSetDomainFilter with unusual parameters (particularly long strings in curTime, sched_name_*, or url_* fields). These may indicate exploitation attempts.
action: No vendor patches available; details: D-Link has not released patches for this vulnerability. Contact D-Link support for official guidance, but expect end-of-life product status confirmation.