Cyber Resilience

CVE-2025-45931

CriticalPublic PoCRCE

Published: 30 June 2025

Published
30 June 2025
Modified
08 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0471 89.6th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-45931 is a critical-severity Command Injection (CWE-77) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2025-45931 is a command-injection vulnerability in the D-Link DIR-816-A2 wireless router running firmware DIR-816A2_FWv1.10CNB05_R1B011D88210. The flaw resides in the system() function inside the bin/goahead binary and is tracked under CWE-77; it carries a CVSS 3.1 base score of 9.8.

An unauthenticated attacker with network access can supply crafted input that reaches the vulnerable function, resulting in arbitrary command execution on the device. Successful exploitation grants the attacker full control over the router, including the ability to read or modify configuration and traffic data or to pivot into the attached network.

Public references point to D-Link’s security-bulletin page and a detailed advisory on GitHub, but the supplied information does not enumerate specific firmware updates or configuration work-arounds.

The associated EPSS score has remained flat at 0.0471 since disclosure, indicating no material increase in observed exploitation interest.

EU & UK References

Vulnerability details

An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Remote arbitrary code execution via system() in the router's web server (goahead) enables exploitation of a public-facing application (T1190) and command execution on a network device CLI (T1059.008).

Affected Assets

dlink
dir-816 firmware
1.10cnb05_r1b011d88210

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References