CVE-2025-6121
BaseFortify
Publication date: 2025-06-16
Last updated on: 2025-06-17
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-632_firmware | 103b08 |
| dlink | dir-632 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-6121 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-632 router firmware version FW103B08. It occurs in the HTTP POST Request Handler's function get_pure_content due to improper bounds checking when handling the Content-Length argument. An attacker can send a specially crafted HTTP POST request with a manipulated Content-Length header to trigger the overflow on the stack, potentially allowing remote exploitation without authentication. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by compromising the confidentiality, integrity, and availability of the affected device. Since exploitation is easy, requires no authentication, and can be performed remotely, an attacker could take control of the router, disrupt network services, or intercept sensitive data. There are no known mitigations, and the affected product is no longer supported, so replacement is recommended. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests with manipulated Content-Length headers targeting the D-Link DIR-632 router firmware FW103B08. Since the exploit involves sending specially crafted HTTP POST requests, network traffic analysis tools like Wireshark or tcpdump can be used to capture and inspect HTTP POST requests for abnormal Content-Length values. Additionally, using curl or similar tools to send crafted POST requests to test the device's response may help detect the vulnerability. However, no specific detection commands or signatures are provided in the available resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected D-Link DIR-632 device running firmware FW103B08, as no known countermeasures or mitigations currently exist. Since the product is no longer supported by the maintainer and the vulnerability can be exploited remotely without authentication, discontinuing use of the vulnerable device and isolating it from untrusted networks is recommended to prevent exploitation. [2]