CVE-2025-55611
Published: 22 August 2025
Summary
CVE-2025-55611 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-619L Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the web interface (formLanguageChange via nextPage) of the public-facing D-Link DIR-619L router enables exploitation of a public-facing application.
NVD Description
D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter.
Deeper analysisAI
CVE-2025-55611 is a buffer overflow vulnerability (CWE-787, CWE-120) in the D-Link DIR-619L router running firmware version 2.06B01. The flaw occurs in the formLanguageChange function when processing the nextPage parameter, potentially allowing memory corruption due to insufficient bounds checking on user-supplied input.
Remote attackers require no authentication, privileges, or user interaction to exploit this vulnerability over the network with low complexity. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that successful exploitation results in high-impact denial of service, such as device crashes or reboots, with no effects on confidentiality or integrity.
References to the vulnerability include GitHub disclosures at https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_80/80.md, which provide additional technical details on the issue. No official patches or vendor advisories are specified in the available information.
Details
- CWE(s)