Dir 816 Firmware CVE-2025-5624

This vulnerability presents CRITICAL real-world risk despite being in end-of-life hardware. Risk signals analysis: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates maximum attack feasibility—network-exploitable, no authentication required, no user interaction needed, low attack complexity; (2) CWE-119 buffer overflow is a well-understood, easily exploitable primitive with decades of exploitation techniques; (3) Public POC disclosure significantly increases EPSS (likely 90%+), meaning exploitation in the wild is probable; (4) End-of-life status (unsupported by maintainer) means no patches will be released, leaving all deployed instances permanently vulnerable; (5) D-Link DIR-816 routers have widespread consumer deployment. The combination of high exploitability (network unauthenticated), severe impact (RCE/full compromise), public POC, and no patch availability creates an extremely dangerous profile. This is NOT a theoretical high-CVSS-low-risk issue—it is an actively exploitable, publicly disclosed vulnerability in widely-deployed hardware with no vendor remediation path. Organizations managing these devices are at urgent risk.

An attacker performs network reconnaissance and identifies a D-Link DIR-816 router accessible on the internet (port 80/443 exposed). The attacker crafts a specially-formed HTTP POST request to http://target-router-ip/goform/QoSPortSetup with an oversized payload in the 'port0_group' or 'ssid0_remarker' parameter containing shellcode (e.g., a reverse shell command). The vulnerable function copies this unterminated/unchecked input into a fixed stack buffer, causing a buffer overflow. The attacker's carefully-constructed payload overwrites the function's return address on the stack with the address of the shellcode (or uses ROP gadgets for ASLR bypass if present). When QoSPortSetup returns, execution redirects to attacker-controlled code, granting the attacker shell access with router root privileges. From this point, the attacker can modify router configuration, inject malware, redirect traffic, perform man-in-the-middle attacks on all connected clients, or pivot to internal network. Given the public POC availability and lack of authentication requirement, this is likely to be automated and used in large-scale IoT device scanning/exploitation campaigns targeting legacy network equipment. Attack execution time is minutes to seconds once the vulnerable target is identified.