CVE-2025-60548

The vulnerability results from improper handling of the curTime parameter in the formLanSetupRouterSettings function — lack of proper validation of input data length (CWE-120, classic buffer overflow). An attacker can send specially crafted network request to the device containing an excessively long value of the curTime parameter, causing a buffer overflow in memory. Due to the network vector (AV:N), lack of authentication requirement (PR:N), and lack of user interaction (UI:N), the attack can be conducted remotely without any additional prerequisites.

Successful exploitation of the vulnerability may allow an attacker to remotely execute arbitrary code (RCE) on the device, and consequently to gain full control over the router, compromising the confidentiality, integrity, and availability of the network.

Apply patches available from the manufacturer according to the references. If an update is not available, it is recommended to restrict access to the device's administrative interface exclusively to trusted hosts on the local network and to disable remote management via WAN. Consider replacing the device with one actively supported by the manufacturer.

D-Link DIR-600L Ax with firmware version 116WWb01