Dir 619l Firmware CVE-2025-6615

This vulnerability presents a high real-world risk despite the product being end-of-life, based on multi-factor analysis: (1) CVSS 8.8 (High) with network-exploitable attack vector (AV:N) and low complexity (AC:L) reflects severe technical impact; (2) Authentication requirement (PR:L) moderately reduces immediate risk but is often bypassed in router exploits via default credentials; (3) Public POC disclosure dramatically increases exploitation probability—EPSS score likely exceeds 70% given active disclosure and simplicity of HTTP exploitation; (4) KEV status unknown from provided data but public disclosure qualifies for active exploitation tracking; (5) Stack-based buffer overflows are highly automatable and consistently lead to RCE. Offsetting factors: The product is unmaintained and likely running in limited deployments (legacy routers), and exploitation requires network access to the web interface (typically restricted to LAN in default configurations). However, for organizations still operating DIR-619L devices (common in developing markets, SMBs with legacy infrastructure), this is a critical priority given the trivial remote exploitation path and complete system compromise potential.

An attacker gains network access to a D-Link DIR-619L router (common in corporate guest networks, SOHO deployments, or networks with weak perimeter security). The attacker either: (a) obtains default credentials (admin/admin or admin/password—common in DIR-619L) via public documentation, or (b) uses a separate vulnerability to bypass authentication. The attacker crafts an HTTP POST request to http://[router-ip]/goform/formAutoDetecWAN_wizard4 with a maliciously-long 'curTime' parameter (e.g., 5000+ characters). The oversized payload overflows the stack buffer allocated for curTime, corrupting the stack frame and overwriting the return address. By carefully constructing the payload with shellcode (ROP gadgets or direct ARM shellcode if the DIR-619L uses ARM architecture, which is typical), the attacker gains code execution in the web server's context (often root on routers). Full compromise follows: attacker modifies DNS settings to redirect traffic, injects malware into firmware, extracts credentials, pivots to connected devices, or uses the router for botnet participation. Exploitation takes <5 minutes with available POC code. No user interaction required beyond initial network access.