Dir 619l Firmware EUVD-2025-18372

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible, low-complexity exploitation requiring low privileges with no user interaction needed, yielding severe impact across confidentiality, integrity, and availability. Multiple factors elevate real-world risk: (1) Public exploit disclosure—threat actors have functional attack code; (2) End-of-life product status—D-Link will not issue patches, eliminating the standard remediation path; (3) Consumer router deployment—DIR-619L is widely deployed in small office/home office (SOHO) environments with poor security hygiene, weak password practices, and infrequent firmware updates; (4) Authenticated attack requirement is mitigated by prevalence of default credentials (admin/admin) on consumer routers and easy network access in most environments. This is a genuine priority threat rather than inflated CVSS—the combination of exploitability, public POC, EOL status, and widespread deployment creates significant risk. Estimated EPSS would likely be elevated (>0.70) due to public exploitation and lack of patching options.

An attacker with network access to the DIR-619L (either on the local network or via exposed web interface) who obtains valid credentials (either default admin/admin or through credential stuffing/phishing) connects to the router's HTTP management interface. The attacker crafts a malicious HTTP POST request to the form_macfilter function, injecting oversized payload into the mac_hostname_%d or sched_name_%d parameters. The oversized input overflows the stack buffer, overwriting the function return address with attacker-controlled code (shellcode). When the function returns, execution jumps to the attacker's shellcode running with router privileges. The attacker achieves remote code execution (RCE) as root, allowing complete device compromise: stealing credentials stored in the router, modifying firewall rules, injecting malicious traffic, pivoting to connected devices, or rendering the device inoperable. Public POC availability means this attack is straightforward to execute—no advanced exploit development required. The low attack complexity (no special conditions, bypass techniques) and widespread default credential usage in SOHO environments make this a practical, repeatable attack at scale.