CVE-2025-6121

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-06-16

Last updated on: 2025-06-17

Assigner: VulDB

Description

A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the component HTTP POST Request Handler. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-06-16

Last Modified

2025-06-17

Generated

2026-07-15

AI Q&A

2025-06-16

EPSS Evaluated

2026-07-13

NVD

CVE-2025-6121

EUVD

EUVD-2025-18394

Affected Vendors & Products

Vendor	Product	Version / Range
dlink	dir-632_firmware	103b08
dlink	dir-632	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

CVE-2025-6121 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-632 router firmware version FW103B08. It occurs in the HTTP POST Request Handler's function get_pure_content due to improper bounds checking when handling the Content-Length argument. An attacker can send a specially crafted HTTP POST request with a manipulated Content-Length header to trigger the overflow on the stack, potentially allowing remote exploitation without authentication. [1, 2]

Impact Analysis

This vulnerability can impact you by compromising the confidentiality, integrity, and availability of the affected device. Since exploitation is easy, requires no authentication, and can be performed remotely, an attacker could take control of the router, disrupt network services, or intercept sensitive data. There are no known mitigations, and the affected product is no longer supported, so replacement is recommended. [2]

Detection Guidance

This vulnerability can be detected by monitoring for suspicious HTTP POST requests with manipulated Content-Length headers targeting the D-Link DIR-632 router firmware FW103B08. Since the exploit involves sending specially crafted HTTP POST requests, network traffic analysis tools like Wireshark or tcpdump can be used to capture and inspect HTTP POST requests for abnormal Content-Length values. Additionally, using curl or similar tools to send crafted POST requests to test the device's response may help detect the vulnerability. However, no specific detection commands or signatures are provided in the available resources. [1, 2]

Mitigation Strategies

Immediate mitigation steps include replacing the affected D-Link DIR-632 device running firmware FW103B08, as no known countermeasures or mitigations currently exist. Since the product is no longer supported by the maintainer and the vulnerability can be exploited remotely without authentication, discontinuing use of the vulnerable device and isolating it from untrusted networks is recommended to prevent exploitation. [2]

Hi! I’m here to help you understand CVE-2025-6121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70