Dir 619l Firmware CVE-2025-6369

CVSS 3.1 score of 8.8 reflects high severity (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and requirement for low-level user privileges. However, real-world risk is elevated by multiple compounding factors: (1) public exploit disclosure significantly increases exploitation likelihood; (2) the device is end-of-life with no vendor patches available, eliminating the primary remediation path; (3) the attack is fully automatable and remotely exploitable; (4) stack overflow vulnerabilities frequently lead to arbitrary code execution on embedded systems with minimal protections (NX/ASLR often absent on legacy routers). While authentication is required (reducing casual exposure), many default router configurations retain default credentials or have weak authentication. The combination of public POC, no patch availability, and likely widespread legacy deployment warrants HIGH priority for organizations still operating DIR-619L devices. EPSS score would likely be elevated given public disclosure and automatable exploitation.

An attacker with network access to a D-Link DIR-619L v2.06B01 device authenticates to the management interface using either compromised credentials, default credentials (common in legacy deployments), or a credential spray attack targeting the router. The attacker then crafts a POST request to /goform/formdumpeasysetup with a maliciously oversized payload in the curTime parameter (e.g., a string exceeding the expected buffer size by hundreds of bytes). The vulnerable function copies this input directly to a stack buffer without length validation, causing a stack overflow. The attacker includes shellcode or ROP gadgets in the overflow payload to overwrite the return address and redirect execution to injected code, achieving remote code execution. Given that routers typically run as root, the attacker gains complete system compromise—enabling persistent backdoor installation, network traffic interception, lateral movement into connected networks, or use of the router as a pivot point for further attacks. Public POC code makes this attack trivial to execute; no advanced exploitation skills are required.