What is the CVSS score of CVE-2025-6617?

CVE-2025-6617 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 619l Firmware are affected by CVE-2025-6617?

D-Link DIR-619L routers (version 2.06B01 and earlier) contain a critical remote code execution vulnerability with no available patch.

Is there a public PoC exploit available for CVE-2025-6617?

Yes, a public proof-of-concept exploit is available for CVE-2025-6617. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6617?

Within 24 hours: Inventory all DIR-619L devices in production and isolate them from critical network segments if possible. Within 7 days: Develop a router replacement plan prioritizing devices accessible from the internet or managing sensitive traffic. Within 30 days: Replace all DIR-619L units with supported alternatives or decommission the devices entirely.

Dir 619l Firmware CVE-2025-6617

EUVD-2025-28755 HIGH

Buffer Overflow (CWE-119)

2025-06-25 cna@vuldb.com

Buffer Overflow D-Link Stack Overflow RCE Dir 619l Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-28755

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jul 14, 2025 - 17:18 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

CVE-2025-6617 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01 affecting the /goform/formAdvanceSetup endpoint. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'webpage' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impacts). The vulnerability has public exploit disclosure and affects only end-of-life products no longer receiving vendor support.

Technical ContextAI

This vulnerability exists in the formAdvanceSetup function within the D-Link DIR-619L wireless router's web management interface. The root cause is a classic stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) where user-supplied input via the 'webpage' parameter is not properly validated or length-checked before being written to a stack buffer. The DIR-619L is a legacy 802.11n WiFi router running proprietary D-Link firmware. The vulnerable endpoint /goform/formAdvanceSetup is part of the router's administrative web interface, typically accessible via HTTP/HTTPS on port 80/443. The affected CPE would be: cpe:2.3:o:d-link:dir-619l_firmware:2.06b01:*:*:*:*:*:*:*. The vulnerability requires authentication (PR:L in CVSS vector), indicating an attacker must first obtain valid credentials or exploit a prior authentication bypass.

RemediationAI

Patch Status: No security patch is available from D-Link due to the DIR-619L being EOL. Remediation Options (in priority order): (1) Replacement: Retire the DIR-619L and replace with a current, actively maintained router model receiving security updates; (2) Network Isolation: If continued use is necessary, isolate the router on a trusted management VLAN with restricted access to router administrative credentials; (3) Credential Management: Change default administrative credentials to a strong, unique password to increase authentication barrier (partial mitigation only); (4) Firmware Verification: Confirm no unauthorized firmware modifications exist; (5) Access Control: Restrict administrative interface access to trusted IP ranges only via router configuration; (6) Monitoring: Implement network monitoring to detect anomalous outbound traffic from the router indicating compromise. Why Workarounds Are Limited: The lack of vendor support means no vendor advisory or patch will be published. Organizations must treat this as a permanent vulnerability requiring compensating controls or hardware replacement.