EUVD-2025-18795
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Analysis
CVE-2025-6373 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L firmware version 2.06B01 affecting the formSetWizard1 function via the /goform/formWlSiteSurvey endpoint. An authenticated remote attacker can exploit this vulnerability by manipulating the 'curTime' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the affected product is end-of-life with no vendor support.
Technical Context
The vulnerability exists in a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) within the wireless site survey form handler on the D-Link DIR-619L router. The formSetWizard1 function fails to properly validate or bounds-check the 'curTime' input parameter before copying it into a fixed-size stack buffer. D-Link DIR-619L is a legacy wireless N router (CPE: cpe:2.3:h:d-link:dir-619l:-:*:*:*:*:*:*:*) running firmware 2.06B01. The vulnerable endpoint /goform/formWlSiteSurvey is accessible through HTTP POST requests via the router's web administration interface. This is a classic memory safety issue common in embedded device firmware written in C/C++ without proper input validation hygiene.
Affected Products
D-Link DIR-619L router, firmware version 2.06B01 and potentially earlier versions sharing the same vulnerable code path. Affected CPE: cpe:2.3:h:d-link:dir-619l:-:*:*:*:*:*:*:*:* with firmware versions ≤2.06B01. Product officially reached end-of-life; D-Link does not provide security updates for this model. No vendor advisory patches are available.
Remediation
Immediate remediation is unavailable via patching (end-of-life product). Recommended actions: (1) DECOMMISSION affected DIR-619L devices and replace with supported hardware from D-Link or alternative vendors; (2) If continued operation is necessary: implement strict network segmentation to restrict web interface access to trusted administrative networks only, disable UPnP/remote management, enforce strong authentication (change default credentials immediately if not already done), and monitor for suspicious access patterns; (3) Deploy WAF/IDS rules to detect POST requests to /goform/formWlSiteSurvey with oversized or malformed 'curTime' parameters; (4) Consider using an external router/firewall to proxy administration traffic and apply input filtering. No patch will be issued by D-Link.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today