EUVD-2025-18370
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the file /goform/form_portforwarding. The manipulation of the argument ingress_name_%d/sched_name_%d/name_%d leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Analysis
Critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01, affecting the port forwarding configuration function. An authenticated remote attacker can exploit this vulnerability by manipulating the ingress_name_%d, sched_name_%d, or name_%d parameters to achieve remote code execution with high integrity and confidentiality impact. The vulnerability has public exploit code available and affects only end-of-life products no longer receiving vendor support, significantly elevating real-world risk for exposed legacy deployments.
Technical Context
The vulnerability exists in the /goform/form_portforwarding endpoint within D-Link DIR-619L wireless routers (CPE: cpe:2.3:o:d-link:dir-619l_firmware:2.06b01:*:*:*:*:*:*:*). The affected function form_portforwarding improperly handles user-supplied input for port forwarding configuration parameters without adequate bounds checking. This constitutes a CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) classic stack-based buffer overflow. The vulnerability allows attackers to write arbitrary data beyond allocated stack buffers, potentially overwriting return addresses and other critical stack structures. The web interface processing of form parameters creates the attack surface, with input validation failures enabling the overflow condition.
Affected Products
D-Link DIR-619L (['2.06B01'])
Remediation
Primary remediation option: Discontinue use of D-Link DIR-619L routers and replace with supported, current-generation networking equipment, as D-Link will not provide security patches for EOL products. Immediate mitigation strategies for organizations unable to immediately replace hardware: (1) Disable remote management access - restrict /goform/form_portforwarding web interface access to local network only via firewall rules; (2) Implement network segmentation - place affected routers on isolated management VLANs with restricted access; (3) Change default credentials immediately and enforce strong authentication if web interface must remain accessible; (4) Monitor network traffic for exploitation attempts targeting the /goform/form_portforwarding endpoint; (5) Deploy intrusion detection rules to identify malformed portforwarding parameters. No official vendor patches exist or will be released. Community-developed firmware replacements (OpenWrt, DD-WRT) may provide alternative solutions if available for this hardware revision, though validation and testing required. Hardware replacement remains the preferred remediation path.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today