Dir 867 Firmware EUVD-2025-18738

CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable attack requiring low privilege context but no user interaction. The 8.8 score reflects high impact (all three CIA triad compromised). However, risk must be contextualized: (1) Product is end-of-life with no vendor support, meaning no patches will be released; (2) Public POC exploits exist, elevating real-world risk significantly; (3) Attack requires authenticated access (PR:L), reducing opportunistic attack surface but not eliminating risk for compromised or default credentials; (4) AC:L (Low Complexity) means exploitation is straightforward once authenticated. While EPSS data is not provided, the combination of public exploits, network accessibility, and complete system compromise potential makes this HIGH priority for affected networks. This is NOT a low-real-risk situation—it represents genuine operational danger to deployed DIR-867 devices.

An attacker with valid administrative credentials (obtained via phishing, credential stuffing, or default credentials on improperly configured devices) crafts a malicious HTTP query string with an oversized parameter. The request is sent to the DIR-867's web administration interface. The Query String Handler processes the request using vulnerable strncpy() without validating input length, causing a stack buffer overflow. The attacker's payload overwrites the return address on the stack, redirecting execution to attacker-controlled code. Result: Remote code execution as the web server process (typically root on router). The attacker can then pivot to access LAN traffic, modify router configuration, deploy persistent malware, or use the router as a proxy for further network attacks. Public POC availability means exploitation tools are pre-built and accessible, lowering the skill barrier significantly. No user interaction is required (UI:N) once authenticated.