What is the CVSS score of CVE-2025-5624?

CVE-2025-5624 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Dir 816 Firmware are affected by CVE-2025-5624?

A critical remote code execution vulnerability (CVE-2025-5624, CVSS 9.8) affects D-Link DIR-816 routers that are no longer supported by the vendor.

Is there a public PoC exploit available for CVE-2025-5624?

Yes, a public proof-of-concept exploit is available for CVE-2025-5624. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2025-5624?

Within 24 hours: Inventory all D-Link DIR-816 devices in production and isolate them from critical network segments if replacement cannot occur immediately. Within 7 days: Replace affected devices with current, supported router models or implement strict network access controls. Within 30 days: Complete migration of all DIR-816 units and validate no legacy unsupported networking equipment remains in use.

Dir 816 Firmware CVE-2025-5624

EUVD-2025-16950 CRITICAL

Buffer Overflow (CWE-119)

2025-06-05 cna@vuldb.com

Buffer Overflow D-Link Dir 816 Firmware RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16950

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 06, 2025 - 15:42 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 01:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /goform/QoSPortSetup. The manipulation of the argument port0_group/port0_remarker/ssid0_group/ssid0_remarker leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Critical stack-based buffer overflow vulnerability in D-Link DIR-816 firmware version 1.10CNB05 affecting the QoSPortSetup function. An unauthenticated remote attacker can exploit this vulnerability by manipulating port0_group, port0_remarker, ssid0_group, or ssid0_remarker parameters to achieve arbitrary code execution, complete system compromise (confidentiality, integrity, availability), and full device takeover. Public exploit code has been disclosed, increasing real-world exploitation risk significantly.

Technical ContextAI

The vulnerability exists in the /goform/QoSPortSetup endpoint of D-Link DIR-816 wireless router firmware, specifically in the QoS (Quality of Service) configuration handler. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow. The vulnerable function fails to properly validate the length of user-supplied input parameters (port0_group, port0_remarker, ssid0_group, ssid0_remarker) before copying them into fixed-size stack buffers. This allows attackers to write beyond allocated buffer boundaries, corrupting the stack frame and overwriting return addresses or other critical data structures. The attack surface is the HTTP form handler endpoint, accessible via the router's web administrative interface. Affected hardware: D-Link DIR-816 router running firmware version 1.10CNB05 (CPE would be: cpe:2.3:o:d-link:dir-816_firmware:1.10cnb05:*:*:*:*:*:*:*).

RemediationAI

No vendor patches are available since this product is end-of-life and no longer supported by D-Link. Remediation options are limited: (1) HARDWARE REPLACEMENT: Organizations still deploying DIR-816 units should immediately plan replacement with current, supported router models from D-Link or alternative vendors; (2) NETWORK ISOLATION: If replacement is not immediately feasible, isolate affected routers from untrusted networks and implement network segmentation to limit exposure; (3) ACCESS RESTRICTION: Disable remote web-based administration (ensure WAN access to HTTP/HTTPS administrative interfaces is blocked); restrict administrative access to trusted internal networks only; (4) FIREWALL RULES: Implement strict firewall policies blocking external access to port 80/443 on affected devices; (5) MONITORING: Enable logging on affected devices and monitor for suspicious QoS configuration requests to /goform/QoSPortSetup endpoint; (6) FIRMWARE CHECK: Verify no other DIR-816 units in inventory are still running 1.10CNB05; if other versions exist, assess if they contain similar vulnerabilities; (7) INCIDENT RESPONSE: Organizations that have deployed DIR-816 units should assume breach risk and audit for signs of compromise (unusual traffic patterns, unauthorized configuration changes, potential command injection artifacts). No upstream patch is forthcoming from D-Link.