Dir 619l Firmware CVE-2025-6373

Risk signals present a mixed but concerning picture: CVSS 8.8 (High) with network accessibility and low attack complexity indicates significant severity, but authentication is required (PR:L reduces immediate exposure). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows the impact is severe once compromised—full system takeover is possible. The presence of publicly disclosed exploit code significantly elevates real-world risk despite authentication requirement, as an attacker with valid router credentials (default/leaked/brute-forced) can trivially trigger RCE. End-of-life status means no patches will be issued by D-Link, making this a permanent vulnerability for deployed devices. SSVC perspective: exploitation is PROVEN (POC public), impact is SEVERE (code execution, system compromise), and remediation is UNAVAILABLE (end-of-life product). Real-world priority is HIGH for any organization still operating DIR-619L devices, particularly if exposed to untrusted networks or if default credentials are in use.

An attacker with network access obtains valid D-Link router administrative credentials (via phishing, credential stuffing, or default credentials if unchanged). The attacker crafts an HTTP POST request to http://<router-ip>/goform/formWlSiteSurvey with an oversized 'curTime' parameter containing shellcode (typically 200+ bytes designed to overflow the stack buffer). The formSetWizard1 function copies this input without bounds checking, corrupting the stack and overwriting the return address with a pointer to attacker-controlled shellcode. Upon function return, code execution occurs with router privilege level, allowing the attacker to install malware, exfiltrate data, modify router settings, pivot to internal network, or render the device inoperable. Public POC code exists, making this trivial to execute for any attacker with credentials. Attack complexity is LOW given the straightforward overflow mechanism and no ASLR/DEP typical on legacy embedded devices.