Cyber Resilience

CVE-2025-55611

HighPublic PoC

Published: 22 August 2025

Published
22 August 2025
Modified
26 September 2025
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0058 69.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-55611 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-619L Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-55611 is a buffer overflow vulnerability (CWE-787, CWE-120) in the D-Link DIR-619L router running firmware version 2.06B01. The flaw occurs in the formLanguageChange function when processing the nextPage parameter, potentially allowing memory corruption due to insufficient bounds checking on user-supplied input.

Remote attackers require no authentication, privileges, or user interaction to exploit this vulnerability over the network with low complexity. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that successful exploitation results in high-impact denial of service, such as device crashes or reboots, with no effects on confidentiality or integrity.

References to the vulnerability include GitHub disclosures at https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_80/80.md, which provide additional technical details on the issue. No official patches or vendor advisories are specified in the available information.

EU & UK References

Vulnerability details

D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in the web interface (formLanguageChange via nextPage) of the public-facing D-Link DIR-619L router enables exploitation of a public-facing application.

CVEs Like This One

CVE-2025-55599Same product: Dlink Dir-619L
CVE-2025-55602Same product: Dlink Dir-619L
CVE-2025-8978Same product: Dlink Dir-619L
CVE-2026-2055Same product: Dlink Dir-619L
CVE-2026-2054Same product: Dlink Dir-619L
CVE-2025-10792Same vendor: Dlink
CVE-2025-46108Same vendor: Dlink
CVE-2025-52222Same vendor: Dlink
CVE-2025-50650Same vendor: Dlink
CVE-2025-60548Same vendor: Dlink

Affected Assets

dlink
dir-619l firmware
2.06b01

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the buffer overflow by enforcing bounds checking and validation on the unauthenticated nextPage parameter in formLanguageChange.

prevent

Requires identification and timely remediation of the specific buffer overflow flaw in the router firmware to eliminate the vulnerability.

prevent

Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow even if input validation fails.

References