EUVD-2025-28731Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
CVE-2025-6374 is a critical stack-based buffer overflow vulnerability in D-Link DIR-619L version 2.06B01, affecting the formSetACLFilter function's curTime parameter. An authenticated remote attacker can exploit this to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. Public exploit code exists for this end-of-life product, making it an immediate concern for organizations still operating legacy D-Link equipment.
Technical ContextAI
This vulnerability is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a stack-based buffer overflow. The vulnerable endpoint /goform/formSetACLFilter in D-Link DIR-619L's web management interface fails to properly validate the length of the 'curTime' parameter before copying it into a fixed-size stack buffer. The DIR-619L is a legacy WLAN router (CPE likely: cpe:2.3:h:dlink:dir-619l:-:*:*:*:*:*:*:*) running embedded Linux with a custom web interface. The vulnerability exists in the firmware's CGI handler that processes Access Control List (ACL) filter configuration requests. Without proper bounds checking, an attacker can overflow the stack, overwriting return addresses and other critical data structures to redirect execution flow.
RemediationAI
No official patch will be released by D-Link for this end-of-life product. Recommended actions: (1) Immediate: Disable remote management access to the router's web interface by disabling WAN-side access to port 80/443 via firewall rules; (2) Network isolation: Segregate affected routers to restricted network segments with minimal trust; (3) Access control: Enforce strong authentication credentials and disable default accounts; (4) Replacement: Migrate to current D-Link router models with active vendor support and security updates; (5) Monitoring: Deploy network IDS/IPS rules to detect exploitation attempts targeting /goform/formSetACLFilter with oversized curTime parameters; (6) Workaround: Restrict web interface access to trusted local networks only and disable any remote management features.
Share
External POC / Exploit Code
Leaving vuln.today