Dir 816 Firmware CVE-2025-5622

This vulnerability presents CRITICAL real-world risk despite being on end-of-life hardware. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects maximum severity: network-accessible, no authentication required, trivial attack complexity, complete system compromise. The combination of public exploit availability and zero-day-like conditions (no vendor patches forthcoming for EOL product) elevates practical risk substantially. Attack surface is exceptionally broad—any Internet-connected DIR-816 with default credentials or accessible management interface is immediately exploitable. While EPSS data is not provided, the presence of public POC code, trivial exploitation requirements (no user interaction), and lack of mitigating factors (no patches available, products still deployed globally) suggests exploitation probability >70%. Unlike theoretical high-CVSS vulnerabilities, this represents immediate actionable threat to installed base, particularly in SMB/SOHO environments where router management interfaces are often directly Internet-exposed. The EOL status is critical: no vendor security updates are forthcoming.

An attacker performs the following attack: (1) Identifies target D-Link DIR-816 router via port scanning (port 80/443 management interface exposed to Internet) or passive reconnaissance; (2) Sends crafted HTTP POST request to http://target-ip/goform/wirelessApcli_5g with oversized payload in apcli_enc_5g parameter (e.g., 2000+ character string); (3) Stack buffer overflow occurs in wirelessApcli_5g function, overwriting return address on stack; (4) Attacker's shellcode executes with router firmware privileges (typically root); (5) Attacker gains persistent access, modifies firewall rules, installs backdoor, harvests WiFi passwords, redirects DNS, or uses router as botnet node. No user interaction required—attack is fully automated and can be launched against thousands of exposed routers via internet-wide scanning. Public POC code likely automates payload generation and delivery.