What is the CVSS score of CVE-2025-6373?

CVE-2025-6373 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6373?

D-Link DIR-619L routers (firmware 2.06B01 and earlier) contain a critical remote code execution vulnerability with active public exploits available.

Is there a public PoC exploit available for CVE-2025-6373?

Yes, a public proof-of-concept exploit is available for CVE-2025-6373. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6373?

Within 24 hours: Inventory all DIR-619L devices in production and isolate any internet-facing instances from the network. Within 7 days: Implement network segmentation to restrict access to administrative interfaces and consider WAF rules blocking requests to /goform/formWlSiteSurvey. Within 30 days: Replace affected devices with supported alternatives, as no patch will be released for this end-of-life product.

Dir 619l Firmware CVE-2025-6373

EUVD-2025-18795 HIGH

Buffer Overflow (CWE-119)

2025-06-21 cna@vuldb.com

Buffer Overflow D-Link Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18795

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Jun 25, 2025 - 20:10 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

CVE-2025-6373 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01 affecting the formSetWizard1 function via the /goform/formWlSiteSurvey endpoint. An authenticated remote attacker can exploit this vulnerability by manipulating the 'curTime' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the affected product is end-of-life with no vendor support.

Technical ContextAI

The vulnerability exists in a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) within the wireless site survey form handler on the D-Link DIR-619L router. The formSetWizard1 function fails to properly validate or bounds-check the 'curTime' input parameter before copying it into a fixed-size stack buffer. D-Link DIR-619L is a legacy wireless N router (CPE: cpe:2.3:h:d-link:dir-619l:-:*:*:*:*:*:*:*) running firmware 2.06B01. The vulnerable endpoint /goform/formWlSiteSurvey is accessible through HTTP POST requests via the router's web administration interface. This is a classic memory safety issue common in embedded device firmware written in C/C++ without proper input validation hygiene.

RemediationAI

Immediate remediation is unavailable via patching (end-of-life product). Recommended actions: (1) DECOMMISSION affected DIR-619L devices and replace with supported hardware from D-Link or alternative vendors; (2) If continued operation is necessary: implement strict network segmentation to restrict web interface access to trusted administrative networks only, disable UPnP/remote management, enforce strong authentication (change default credentials immediately if not already done), and monitor for suspicious access patterns; (3) Deploy WAF/IDS rules to detect POST requests to /goform/formWlSiteSurvey with oversized or malformed 'curTime' parameters; (4) Consider using an external router/firewall to proxy administration traffic and apply input filtering. No patch will be issued by D-Link.