CVE-2025-60548
Published: 24 October 2025
Summary
CVE-2025-60548 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Dir-600L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-60548 is a buffer overflow vulnerability (CWE-120) in the D-Link DIR-600L Ax router running firmware version FW116WWb01. The flaw occurs in the formLanSetupRouterSettings function when processing the curTime parameter, potentially allowing memory corruption due to insufficient bounds checking on user-supplied input.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Remote attackers require only network access, with low attack complexity, no privileges, and no user interaction. Exploitation can achieve high impacts on confidentiality, integrity, and availability, enabling arbitrary code execution or denial of service on the affected device.
Mitigation details are available in the vulnerability advisory published on GitHub at https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/01-buffer%20overflow-formLanSetupRouterSettings.md. Security practitioners should review this resource for technical analysis, proof-of-concept information, and recommended remediation steps, such as firmware updates if available from D-Link.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35864
Vulnerability details
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow via curTime parameter in formLanSetupRouterSettings enables remote code execution by exploiting the router's public-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and bounds checking of user-supplied inputs like the curTime parameter to prevent buffer overflows in the formLanSetupRouterSettings function.
Mandates timely identification, reporting, and remediation of flaws such as this buffer overflow via firmware updates or patches.
Implements memory protections like non-executable memory regions to block arbitrary code execution from buffer overflow exploitation.