Dir 619l Firmware CVE-2025-6617

While the CVSS 3.1 score of 8.8 (High) reflects severe technical impact potential, real-world risk is heavily contextualized by multiple factors: (1) Attack Vector: Network-based with low complexity favors attackers; (2) Authentication Requirement: Requires PR:L (low privileges), narrowing the threat actor pool to users with router access or those who can compromise weak default credentials; (3) EOL Status: D-Link DIR-619L is discontinued and receives no security updates, eliminating patch availability and creating permanent exposure for installed devices; (4) Public PoC Availability: Disclosed exploits significantly increase exploitation probability and lower barriers for non-sophisticated threat actors; (5) Affected User Base: Legacy home/small office routers typically have weak credential management and unpatched firmware, increasing likelihood of successful compromise. SSVC Assessment: Exploitation is witnessed/public, the attack is easily automatable via script, and technical impact is complete system compromise. The key mitigating factor is the authentication requirement—this is not a zero-click worm vector. Real-world Priority: HIGH for any organization with these routers still deployed in production. The combination of public PoC, no patch availability, EOL status, and trivial attack execution makes this a persistent risk for legacy network infrastructure.

A threat actor with valid credentials (obtained via weak default password, phishing, or prior compromise) accesses the D-Link DIR-619L administrative web interface at http://192.168.0.1/goform/formAdvanceSetup. The attacker crafts a malicious HTTP POST request with an oversized or specially crafted 'webpage' parameter containing a buffer overflow payload (shellcode). The unvalidated parameter overwrites the stack, corrupting the function return address and redirecting execution to attacker-controlled code. Exploitation results in remote code execution (RCE) within the router's Linux kernel context, allowing the attacker to: install persistent backdoors, intercept network traffic from all connected devices, modify DNS settings for phishing attacks, or use the router as a botnet node. The low CVSS complexity (AC:L) and network attack vector (AV:N) mean exploitation is trivial once credentials are obtained. Public PoC code would enable script-based scanning and exploitation of thousands of vulnerable routers on the internet.