CVE-2025-60548
Published: 24 October 2025
Summary
CVE-2025-60548 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Dir-600L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and bounds checking of user-supplied inputs like the curTime parameter to prevent buffer overflows in the formLanSetupRouterSettings function.
Mandates timely identification, reporting, and remediation of flaws such as this buffer overflow via firmware updates or patches.
Implements memory protections like non-executable memory regions to block arbitrary code execution from buffer overflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow via curTime parameter in formLanSetupRouterSettings enables remote code execution by exploiting the router's public-facing web application.
NVD Description
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings.
Deeper analysisAI
CVE-2025-60548 is a buffer overflow vulnerability (CWE-120) in the D-Link DIR-600L Ax router running firmware version FW116WWb01. The flaw occurs in the formLanSetupRouterSettings function when processing the curTime parameter, potentially allowing memory corruption due to insufficient bounds checking on user-supplied input.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Remote attackers require only network access, with low attack complexity, no privileges, and no user interaction. Exploitation can achieve high impacts on confidentiality, integrity, and availability, enabling arbitrary code execution or denial of service on the affected device.
Mitigation details are available in the vulnerability advisory published on GitHub at https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/01-buffer%20overflow-formLanSetupRouterSettings.md. Security practitioners should review this resource for technical analysis, proof-of-concept information, and recommended remediation steps, such as firmware updates if available from D-Link.
Details
- CWE(s)