Cyber Resilience

CVE-2025-5620

MediumPublic PoC

Published: 05 June 2025

Published
05 June 2025
Modified
06 June 2025
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0673 91.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-5620 is a medium-severity Command Injection (CWE-77) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A critical OS command injection vulnerability, tracked as CVE-2025-5620 and assigned CWE-77 and CWE-78, affects the D-Link DIR-816 router running firmware 1.10CNB05. The flaw resides in the setipsec_config function of the /goform/setipsec_config endpoint, where unsanitized input to the localIP and remoteIP parameters is passed directly to the operating system.

An unauthenticated attacker can exploit the issue remotely by sending a crafted HTTP request that injects arbitrary commands. Successful exploitation grants the ability to execute operating-system-level actions with limited effects on confidentiality, integrity, and availability; a public proof-of-concept has already been released.

The affected device line is no longer supported by D-Link, and the vendor’s site provides no patches or mitigation guidance for this firmware. The EPSS score remains flat at 0.0673 with no observed increase after disclosure.

EU & UK References

Vulnerability details

A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec_config. The manipulation of the argument localIP/remoteIP leads to os command injection. It is possible to launch the attack…

more

remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CWE(s)
CWE-77CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

Unauthenticated OS command injection via public-facing web form (/goform/setipsec_config) enables exploitation of public-facing application (T1190), indirect command execution through web CGI (T1202), and abuse of command interpreter/shell (T1059).

Affected Assets

dlink
dir-816 firmware
1.10cnb05

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References