EUVD-2025-16952
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Analysis
Critical stack-based buffer overflow vulnerability in D-Link DIR-816 firmware version 1.10CNB05 affecting the /goform/form2lansetup.cgi endpoint. An unauthenticated remote attacker can exploit this vulnerability by manipulating the 'ip' parameter to achieve complete system compromise including data exfiltration, integrity violation, and denial of service. The vulnerability has public exploit code available and affects end-of-life products no longer receiving vendor support.
Technical Context
This vulnerability exists in the web management interface of D-Link DIR-816 routers, specifically within the form2lansetup.cgi CGI script that handles LAN configuration. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), manifesting as a classic stack-based buffer overflow in the 'ip' parameter processing. The CGI script likely uses unsafe string handling functions (strcpy, sprintf, or similar) without proper bounds checking when parsing user-supplied IP address input. The DIR-816 is a residential-grade wireless router with embedded web server functionality. Affected CPE: cpe:2.3:o:d-link:dir-816_firmware:1.10cnb05:*:*:*:*:*:*:*. This firmware version represents legacy hardware that reached end-of-life status, meaning D-Link has terminated security patch development.
Affected Products
DIR-816 (['1.10CNB05'])
Remediation
D-Link has not released patches for this end-of-life product. Remediation options: (1) Hardware replacement: Discontinue use of DIR-816 v1.10CNB05 and deploy current-generation D-Link routers receiving active security support; (2) Network isolation: If hardware replacement is not immediately feasible, restrict network access to the router's web management interface using firewall rules, allowing management access only from trusted administrative networks; (3) Disable web management: If remote management is not required, disable HTTP/HTTPS web interface access and manage router via alternative methods (serial console, local only); (4) Monitor for exploitation: Implement intrusion detection signatures for attempts to access /goform/form2lansetup.cgi with malformed 'ip' parameters; (5) Firmware alternatives: Investigate third-party open-source firmware (OpenWrt, DD-WRT if supported) that may have security patches for this hardware line, though compatibility and stability should be thoroughly tested first.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today