Dir 655 Firmware EUVD-2025-18473

This vulnerability presents CRITICAL real-world risk despite the authentication requirement. CVSS 3.1 score of 8.8 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requiring only low privileges (PR:L), with no user interaction needed (UI:N), resulting in complete system compromise (C:H/I:H/A:H). The disclosure of public exploit code substantially increases exploitation likelihood. The critical risk factors are: (1) End-of-life product with zero vendor support or patches available, (2) Stack overflow enabling code execution, (3) Authentication requirement is minimal friction since many routers use default credentials, (4) Network accessibility from authenticated LAN/WAN access. Using SSVC framework: exploitation is public/active, the impact is complete system compromise (RCE), and this is automatable. This should be rated as IMMEDIATE priority for any organization still operating DIR-665 devices. EPSS score would likely exceed 0.85+ given public POC availability.

An attacker on the same network as a D-Link DIR-665 (or with WAN access if management interface is exposed) authenticates to the router's web management portal using default or weak credentials (commonly 'admin/admin'). The attacker crafts a malicious HTTP POST request to the vulnerable sub_AC78 function with an oversized payload in a buffer field (e.g., SSID, hostname, or other form parameter). The stack buffer overflows, overwriting the return address or other critical stack data. The attacker controls execution flow and executes arbitrary code with router root privileges, gaining complete control of the device. From this position, the attacker can modify firewall rules, redirect DNS traffic, eavesdrop on network communications, or use the router as a pivot point to attack internal network devices. Public POC code likely exists as an HTTP POST fuzzer or python script that automatically triggers the overflow with shellcode payload.