External risk intelligence

D-Link DIR-600L Firmware Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60554

This CVE affects a D-Link home router firmware. Routers are network edge devices by design, frequently acting as the gateway between the public internet and internal networks. Vulnerabilities in the administration or management interface of such devices are commonly reachable from the internet or local network segments, making them a typical internet-facing service in standard deployment patterns.

Buffer Overflow

Dlink Dir 600l Firmware

1.16wwb01

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in D-Link DIR-600L router firmware, specifically a buffer overflow issue related to the `curTime` parameter in the `formSetEnableWizard` function. This type of vulnerability could allow an attacker to execute arbitrary code, potentially impacting the confidentiality, integrity, and availability of the affected device and the network it manages. The main concern is confirming the relevance and exposure of this vulnerability within our environment.

Firmware overflow allows remote code execution.
Critical routers could be compromised remotely.
Confirm affected devices and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target a vulnerable D-Link router by sending a specially crafted request to its web interface, exploiting a buffer overflow vulnerability in the `formSetEnableWizard` function. This vulnerability, triggered by manipulating the `curTime` parameter, could allow an attacker to gain control over the device, potentially leading to data breaches or network disruption.

No authentication required to access.
Vulnerable when `curTime` parameter is manipulated.
Complete device compromise and data theft.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow in the router's firmware could allow an unauthenticated attacker to execute arbitrary code. This could impact the router's normal operation and potentially allow for unauthorized access to the network it manages.

Router system control.
Network-based command injection.
Device compromise and network disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, owners of D-Link DIR-600L routers should first confirm the presence and network exposure of this device. Identifying the specific business-criticality and assigning an accountable owner will inform the remediation plan, which may involve vendor coordination or temporary risk reduction measures.

Determine router ownership and business impact.
Verify external or internal network reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-600L device?

The D-Link DIR-600L is a home router designed to manage network traffic and provide internet connectivity for connected devices. It runs proprietary firmware, specifically version 1.16WWb01, which controls how the hardware processes network requests and handles administrative management tasks.

What does CVE-2025-60554 mean?

This CVE identifies a buffer overflow vulnerability, categorized as CWE-120. In plain terms, the software fails to properly check the size of incoming data, allowing an attacker to overwrite memory areas by sending too much information. This specific flaw exists in the router's internal processing of the curTime parameter.

How is this buffer overflow triggered?

An attacker triggers this vulnerability by sending a maliciously crafted network request to the router's web interface. The flaw resides within the formSetEnableWizard function. It is important to note that the vulnerability is specifically triggered by manipulating the curTime parameter; standard, non-malicious interactions with the device settings do not cause this error.

Is my D-Link router at risk?

According to Halo Surface Signal, this router is an edge device that typically serves as a gateway between the internet and your internal network. Because the vulnerability is reachable through the web interface without requiring authentication, any DIR-600L exposed to the public internet is at a higher risk of being targeted than one restricted to an internal segment.

What should I do if I use this router?

Your first step is to locate all instances of this specific D-Link model within your network and verify if they are accessible from the internet. Once identified, evaluate the criticality of the networks these devices manage to prioritize your response. Consult the manufacturer for available updates and consider isolating exposed devices from direct external access until a solution is implemented.

References

github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/mai…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.