Dir 619l Firmware CVE-2025-6616

Despite the high CVSS score of 8.8, real-world risk is moderated by several factors: (1) The vulnerability requires authentication (PR:L in CVSS vector), reducing exposed attack surface to authenticated sessions only; (2) The product is end-of-life with no vendor support, meaning patches are unavailable and affected users must replace hardware; (3) Public exploit disclosure increases likelihood of active exploitation in the wild, particularly against legacy devices in production environments that have not been replaced. The combination of public POC availability, authentication requirement, and end-of-life status creates a HIGH but not CRITICAL real-world priority—organizations must identify and retire affected devices rather than wait for patches. If KEV/EPSS data were available, public POC disclosure would likely elevate EPSS to >30%, indicating meaningful exploitation probability.

An authenticated attacker with valid credentials to the DIR-619L web management interface submits a crafted POST request to /goform/formSetWAN_Wizard51 with an oversized or specially crafted curTime parameter containing shellcode or ROP gadgets. The stack buffer overflows, corrupting the return address on the stack. Upon function return, execution jumps to attacker-controlled code, allowing arbitrary command execution with router privileges (typically root). The attacker gains full control: they can modify firewall rules, intercept/modify network traffic, establish persistence (backdoor installation), or use the compromised router as a pivot point for lateral network attacks. Attack complexity is low due to simple parameter injection; the authentication requirement means this is most dangerous for compromised user credentials or in environments where the router's web interface is exposed to the internet (misconfigured or legacy). With public POC availability, exploitation toolkits likely exist in security forums and automated scanners.