External risk intelligence

D-Link DIR-600L Buffer Overflow in formLanSetupRouterSettings

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60548

This vulnerability affects a consumer-grade D-Link wireless router. Routers are designed to be network-facing devices. While the specific function involves local area network (LAN) settings, home routers are frequently exposed to the internet via management interfaces or WAN-side services, making internet-reachable exploitation a common deployment scenario for this class of device.

Buffer Overflow

Dlink Dir 600l Firmware

1.16wwb01

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security flaw found in D-Link DIR-600L router firmware, specifically related to a buffer overflow vulnerability in the function that manages LAN setup. This type of vulnerability can allow attackers to potentially gain unauthorized control over the affected devices and the networks they manage, posing a significant risk to network security and data integrity.

Router firmware has a critical flaw.
It impacts network security and control.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by targeting the router's network interface. By sending a specially crafted request to the router, they could trigger a buffer overflow in the `formLanSetupRouterSettings` function, potentially leading to the execution of arbitrary code.

No authentication required for access.
Exploited through the `curTime` parameter.
Risk includes code execution and denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to overwrite memory by sending a malformed request to the router's web interface. This could potentially disrupt the router's operation and affect network services.

Router firmware could be compromised.
Malicious requests could be sent to the device.
Network disruption and service interruption may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in D-Link DIR-600L firmware is likely exploitable externally. Network and security teams should prioritize identifying all instances of this device within the environment, confirming their exposure and business criticality, and then coordinating with the accountable owner for remediation.

Network and security teams own the issue.
Verify device exposure and business criticality first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-600L router?

The D-Link DIR-600L is a consumer-grade wireless router designed to provide home internet connectivity. It uses specific firmware, identified here as version Ax FW116WWb01, to manage network traffic, Wi-Fi settings, and LAN configurations.

What does the buffer overflow in CVE-2025-60548 mean?

This vulnerability is classified as CWE-120, which involves a buffer overflow. In plain terms, the router's software fails to check the size of incoming data properly. By sending too much information to a specific part of the system, an attacker can crash the device or potentially run their own unauthorized instructions.

How is this buffer overflow triggered?

An attacker triggers the vulnerability by sending a malformed or oversized value to the 'curTime' parameter within the router's web-based LAN setup function. Simple, legitimate use of the router's administrative dashboard for standard configuration does not trigger this flaw; it requires specifically crafted malicious input.

Is my D-Link DIR-600L at risk?

According to Halo Surface Signal, this device is considered likely to be at risk. Because the DIR-600L is a router, it is inherently designed to sit at the edge of a network. Even if settings are intended for local management, these devices are often reachable from the internet, increasing the likelihood that they are exposed to external threats.

What should I do if I use this D-Link device?

Start by confirming if any D-Link DIR-600L units are active in your environment. Once identified, evaluate whether these devices are internet-facing or handling sensitive traffic. Prioritize isolating affected units from public network access and coordinate with your internal teams or the vendor to plan for firmware updates or device replacement.

References

github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/mai…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.