CVE-2025-60550
📋 TL;DR
A buffer overflow vulnerability in D-Link DIR600L Ax router firmware allows attackers to execute arbitrary code by sending specially crafted requests to the formEasySetTimezone function. This affects users running FW116WWb01 firmware on DIR600L Ax routers. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- D-Link DIR600L Ax
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router crash/reboot causing temporary network disruption, or limited code execution for reconnaissance.
If Mitigated
Denial of service if exploit fails or is detected by network monitoring.
🎯 Exploit Status
Public GitHub repository contains detailed analysis and likely exploit code. Buffer overflow in curTime parameter suggests straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: Yes
Instructions:
1. Check D-Link support site for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after update.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace affected router with supported model
- Implement strict firewall rules blocking all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: System > Firmware. If version is FW116WWb01, device is vulnerable.Check Version:
Check router web interface or use nmap/router scanning tools to identify firmware version.Verify Fix Applied:
Verify firmware version has changed from FW116WWb01 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to formEasySetTimezone with abnormal curTime parameter values
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to router management interface with oversized curTime parameter
- Traffic patterns suggesting router compromise
SIEM Query:
http.method:POST AND http.uri:*formEasySetTimezone* AND http.param.curTime.length>100