Dir 619l Firmware EUVD-2025-18794

While the CVSS 3.1 score of 8.8 is high, the real-world risk must be contextualized through multiple signals: (1) CVSS vector AV:N/AC:L/PR:L/UI:N/S:U indicates network-accessible attack with low complexity but requires LOW privilege authentication, reducing immediate risk for unauthenticated threat actors; (2) Public POC availability and disclosed exploitation status elevate practical exploitation probability; (3) End-of-life vendor status means NO patch will be released, making this a permanent vulnerability in deployed installations; (4) The router's use in SOHO deployments suggests moderate deployment scale but typically in security-conscious organizations upgrading to supported firmware. The SSVC framework suggests: exploitation is active/public (high), potentially automatable via routing to vulnerable endpoint (high automatable factor), and technical impact is code execution (high). Risk priority is HIGH for organizations still operating DIR-619L hardware in production, MEDIUM for those with migration timelines, and LOW for enterprises with modern device inventories. This is not a 'low real-risk high CVSS' scenario—the authentication requirement is the primary limiting factor.

A threat actor with network access to an organization's SOHO router (either internal network access or compromised credentials from credential stuffing/phishing) authenticates to the router's web administration interface at http://[router-ip]/admin/. The attacker navigates to the wizard setup page (/goform/formSetEnableWizard) and crafts a malicious HTTP POST request with an oversized 'curTime' parameter containing shellcode and ROP gadgets. The parameter overflows the stack buffer, overwrites the saved return address, and redirects execution to attacker-controlled code. The attacker gains root-level code execution on the router, enabling them to: intercept traffic (MITM attacks on connected devices), modify routing/DNS settings (redirect users to phishing sites), establish persistence, or pivot to internal network devices. With public POC available, this scenario is reproducible by script-kiddies with basic HTTP fuzzing tools.