What is the CVSS score of EUVD-2025-16942?

EUVD-2025-16942 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 1.0%.

Which versions of Dir 816 Firmware are affected by EUVD-2025-16942?

D-Link DIR-816 routers running firmware 1.10CNB05 contain a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands.

Is there a public PoC exploit available for EUVD-2025-16942?

Yes, a public proof-of-concept exploit is available for EUVD-2025-16942. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate EUVD-2025-16942?

Within 24 hours: Inventory all D-Link DIR-816 devices and isolate affected units from production networks if possible. Within 7 days: Implement network segmentation to restrict administrative access to affected devices and deploy WAF rules blocking requests to /goform/qosClassifier. Within 30 days: Develop and execute a replacement plan for all DIR-816 units with supported hardware, establishing a target decommission date.

Dir 816 Firmware EUVD-2025-16942

| CVE-2025-5621 HIGH

Command Injection (CWE-77)

2025-06-05 cna@vuldb.com

Command Injection D-Link RCE Dir 816 Firmware

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-16942

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 06, 2025 - 15:42 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 00:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.