EUVD-2026-12247Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link DIR-619L web interface
-
DeliverySend crafted request to /goform/formSchedule
-
ExploitManipulate curTime parameter with oversized payload
-
ExecutionTrigger stack-based buffer overflow
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | D-Link DIR-619L firmware version 2.06B01 with boa web server enabled; requires valid authentication credentials to access /goform/formSchedule endpoint; affects end-of-life unsupported devices only. |
| Impact | This represents a high real-world risk despite no KEV listing. The CVSS 8.8 score reflects network-accessible (AV:N), low complexity (AC:L) attacks requiring only low privileges (PR:L). The exploit is publicly available on GitHub, significantly increasing risk. While EPSS data is not provided, the combination of public exploit code, remote exploitability, and end-of-life status suggests active exploitation is likely. The SSVC framework would classify this as high priority due to: public exploit (E:P), network automatable attack, and high technical impact (complete system compromise). |
| Exploit ScenarioDerived | An attacker with valid low-privilege credentials (or using default credentials if unchanged) can remotely access the router's web interface and send a specially crafted HTTP request to /goform/formSchedule with an oversized curTime parameter. This triggers a stack overflow, allowing arbitrary code execution with the privileges of the boa web server process. The public exploit code available at https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_89/89.md provides a working proof-of-concept, making attacks trivial to execute. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Remote code execution in D-Link DIR-619L 2.06B01 results from a stack-based buffer overflow in the formSchedule function when the curTime parameter is manipulated via the /goform/formSchedule endpoint. An authenticated remote attacker can exploit this vulnerability to achieve full system compromise, and public exploit code is currently available. This vulnerability affects only end-of-life devices that no longer receive security updates.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the formSchedule function of D-Link DIR-619L router firmware version 2.06B01, allowing remote attackers with low privileges to execute arbitrary code by manipulating the curTime parameter. This vulnerability has a publicly available proof-of-concept exploit and affects end-of-life products no longer supported by D-Link, making patching unlikely.
RemediationAI
No official patch is available as D-Link has discontinued support for the DIR-619L series. Immediate mitigation steps include: 1) Replace affected DIR-619L routers with supported models, 2) If replacement is not immediately possible, disable remote administration features and restrict access to the web interface to trusted local networks only, 3) Monitor for suspicious access attempts to /goform/formSchedule endpoints. The D-Link website (https://www.dlink.com/) should be consulted for recommended replacement products.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the boa web server component, specifically in the /goform/formSchedule endpoint of D-Link DIR-619L routers. This is a classic stack-based buffer overflow (CWE-121) where improper boundary checking on the curTime input parameter allows attackers to overwrite stack memory. The CPE identifier (cpe:2.3:a:d-link:dir-619l:*:*:*:*:*:*:*:*) indicates all versions of the DIR-619L firmware are potentially affected, though the specific confirmed vulnerable version is 2.06B01.
Know when Dir 619l gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
D-Link DIR-619L routers running firmware 2.06B01 are vulnerable to remote code execution through a stack buffer overflow, with public exploits now available. Organizations using these end-of-life devices face immediate risk of compromise, as the vendor will not release patches. This affects network perimeter security and any systems relying on these devices for connectivity or traffic management.
Network segmentation: restrict access to affected devices using firewall rules and ACLs; disable remote management features (telnet, SSH, HTTP/HTTPS access) if not operationally required; place devices behind a WAF or IPS configured to block malicious formSchedule requests with suspicious curTime parameters; monitor for exploitation attempts targeting /goform/formSchedule endpoint; consider blocking WAN access entirely and limiting to trusted LAN sources only. Note: These are temporary measures only—device replacement is mandatory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB