CVE-2025-60554
Published: 24 October 2025
Summary
CVE-2025-60554 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Dir-600L Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the curTime parameter to directly prevent buffer overflow exploitation in the formSetEnableWizard function.
Mandates timely remediation of the buffer overflow flaw through firmware patching or updates to eliminate the vulnerability.
Implements memory protection mechanisms like ASLR and DEP to mitigate arbitrary code execution from successful buffer overflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing web management interface (formSetEnableWizard via curTime parameter) enables exploitation for initial access via public-facing application.
NVD Description
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard.
Deeper analysisAI
CVE-2025-60554 is a buffer overflow vulnerability (CWE-120) in D-Link DIR600L Ax firmware version FW116WWb01. It is triggered via the curTime parameter in the formSetEnableWizard function, earning a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) due to its potential for high-impact confidentiality, integrity, and availability violations.
An unauthenticated remote attacker can exploit this over the network with low complexity by sending a specially crafted request to the vulnerable parameter. Exploitation could result in arbitrary code execution on the device, enabling full control, data exfiltration, configuration changes, or device crashes.
The vulnerability is documented in a GitHub proof-of-concept at https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/08-buffer%20overflow-formSetEnableWizard.md. No official D-Link advisories or patches are referenced; security practitioners should monitor for firmware updates, restrict web interface access via firewalls, and consider device replacement for end-of-life models.
Details
- CWE(s)