CVE-2025-6121
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-06-16

Last updated on: 2025-06-17

Assigner: VulDB

Description
A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the component HTTP POST Request Handler. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-16
Last Modified
2025-06-17
Generated
2026-06-19
AI Q&A
2025-06-16
EPSS Evaluated
2026-06-18
NVD
CVE-2025-6121
EUVD
EUVD-2025-18394
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
dlink dir-632_firmware 103b08
dlink dir-632 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-6121 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-632 router firmware version FW103B08. It occurs in the HTTP POST Request Handler's function get_pure_content due to improper bounds checking when handling the Content-Length argument. An attacker can send a specially crafted HTTP POST request with a manipulated Content-Length header to trigger the overflow on the stack, potentially allowing remote exploitation without authentication. [1, 2]

Impact Analysis

This vulnerability can impact you by compromising the confidentiality, integrity, and availability of the affected device. Since exploitation is easy, requires no authentication, and can be performed remotely, an attacker could take control of the router, disrupt network services, or intercept sensitive data. There are no known mitigations, and the affected product is no longer supported, so replacement is recommended. [2]

Detection Guidance

This vulnerability can be detected by monitoring for suspicious HTTP POST requests with manipulated Content-Length headers targeting the D-Link DIR-632 router firmware FW103B08. Since the exploit involves sending specially crafted HTTP POST requests, network traffic analysis tools like Wireshark or tcpdump can be used to capture and inspect HTTP POST requests for abnormal Content-Length values. Additionally, using curl or similar tools to send crafted POST requests to test the device's response may help detect the vulnerability. However, no specific detection commands or signatures are provided in the available resources. [1, 2]

Mitigation Strategies

Immediate mitigation steps include replacing the affected D-Link DIR-632 device running firmware FW103B08, as no known countermeasures or mitigations currently exist. Since the product is no longer supported by the maintainer and the vulnerability can be exploited remotely without authentication, discontinuing use of the vulnerable device and isolating it from untrusted networks is recommended to prevent exploitation. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-6121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart