What is the CVSS score of CVE-2025-6371?

CVE-2025-6371 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6371?

A critical stack-based buffer overflow vulnerability (CVE-2025-6371) affects unsupported D-Link DIR-619L routers, allowing remote attackers to potentially execute arbitrary code with a high CVSS…

Is there a public PoC exploit available for CVE-2025-6371?

Yes, a public proof-of-concept exploit is available for CVE-2025-6371. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6371?

Within 24 hours: Inventory all D-Link DIR-619L devices in production and isolate them from critical network segments; notify affected business units of the risk. Within 7 days: Implement network-based mitigations (WAF rules blocking /goform/formSetEnableWizard requests with malformed curTime parameters, or restrict administrative access via firewall rules). Within 30 days: Develop and execute a replacement plan for affected routers with supported, patched alternatives; document any devices that cannot be immediately replaced and implement enhanced monitoring on those systems.

Dir 619l Firmware CVE-2025-6371

EUVD-2025-18794 HIGH

Buffer Overflow (CWE-119)

2025-06-20 cna@vuldb.com

RCE Buffer Overflow D-Link Stack Overflow Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18794

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 25, 2025 - 20:09 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

CVE-2025-6371 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01 affecting the formSetEnableWizard function. An authenticated remote attacker can exploit this vulnerability by manipulating the 'curTime' parameter to achieve remote code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation has been publicly disclosed with proof-of-concept available, and this vulnerability only affects end-of-life products no longer receiving vendor support.

Technical ContextAI

The vulnerability exists in the web management interface of D-Link DIR-619L routers at the endpoint /goform/formSetEnableWizard. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The formSetEnableWizard function fails to properly validate or bound-check the 'curTime' parameter before writing it to a stack buffer, allowing an attacker to overwrite stack memory including return addresses and local variables. This is a classic memory safety issue common in embedded device firmware written in C/C++ without modern protections. The affected product is the D-Link DIR-619L wireless router (CPE: cpe:2.3:o:d-link:dir-619l_firmware:2.06b01:*:*:*:*:*:*:*), which is a residential-grade SOHO router typically deployed in small business and home networks.

RemediationAI

Patch: No security patches will be released by D-Link for this end-of-life product. Workarounds and mitigations: (1) Immediately retire DIR-619L devices and replace with supported alternatives from D-Link or other vendors; (2) If temporary operation is required, restrict network access to the management interface via firewall rules—disable remote management and limit local management access to trusted networks only; (3) Implement network segmentation to isolate affected routers from sensitive systems; (4) Monitor for signs of exploitation (unauthorized configuration changes, unexpected traffic patterns); (5) Consider firmware alternatives if available (OpenWrt, DD-WRT) if they support DIR-619L hardware, though users assume responsibility for security testing; (6) Prioritize budget allocation for equipment refresh cycles to eliminate end-of-life devices from production networks.