What is the CVSS score of CVE-2025-6614?

CVE-2025-6614 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6614?

D-Link DIR-619L routers (version 2.06B01) contain a critical stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code without authentication.

Is there a public PoC exploit available for CVE-2025-6614?

Yes, a public proof-of-concept exploit is available for CVE-2025-6614. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6614?

Within 24 hours: Inventory all DIR-619L 2.06B01 devices across the organization and isolate them from production networks if business continuity permits. Within 7 days: Replace affected devices with supported models from D-Link or alternative vendors; if replacement is unavailable, implement network segmentation to restrict WAN management access and disable remote administration. Within 30 days: Complete migration of all DIR-619L devices; conduct network forensics on affected systems for signs of compromise; update device inventory policies to prohibit end-of-life hardware.

Dir 619l Firmware CVE-2025-6614

EUVD-2025-19105 HIGH

Buffer Overflow (CWE-119)

2025-06-25 cna@vuldb.com

RCE Buffer Overflow D-Link Stack Overflow Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19105

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jul 16, 2025 - 19:35 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

CVE-2025-6614 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01 affecting the WAN configuration function. An authenticated remote attacker can exploit this vulnerability by manipulating the 'curTime' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impacts). The vulnerability has public exploit disclosure and affects only end-of-life products no longer receiving vendor support.

Technical ContextAI

This vulnerability exists in the formSetWANType_Wizard5 CGI handler located at /goform/formSetWANType_Wizard5, which processes WAN type configuration requests on D-Link DIR-619L routers. The root cause is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The vulnerable code fails to properly validate the length of the 'curTime' input parameter before copying it into a fixed-size stack buffer, allowing an attacker to write beyond allocated memory boundaries. D-Link DIR-619L is a consumer-grade wireless router (CPE: cpe:2.3:h:d-link:dir-619l:*:*:*:*:*:*:*:*) running firmware 2.06B01 or earlier (CPE: cpe:2.3:o:d-link:dir-619l_firmware:2.06b01:*:*:*:*:*:*:*). The CGI application likely uses unsafe C functions (strcpy, sprintf, or similar) without bounds checking.

RemediationAI

Primary Remediation: No vendor security patches exist for CVE-2025-6614 due to end-of-life status of the DIR-619L product line. Users must replace affected routers with current, supported D-Link models or alternative vendors. Interim Mitigations (if replacement is not immediately feasible): (1) Restrict administrative access via network segmentation—disable remote management and limit access to trusted LAN subnets only; (2) Disable or restrict access to /goform/formSetWANType_Wizard5 endpoint via firewall rules if possible; (3) Change default credentials and enforce strong authentication passwords; (4) Isolate affected routers on separate VLANs with limited trust relationships; (5) Monitor router logs for CGI-related errors or unusual parameter submissions. Long-term: Plan and execute device replacement with current firmware versions receiving active security maintenance.