CVE-2025-5621
Published: 05 June 2025
Summary
CVE-2025-5621 is a medium-severity Command Injection (CWE-77) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability has been identified in the D-Link DIR-816 router running firmware version 1.10CNB05 and classified as critical. It resides in the qosClassifier function within the /goform/qosClassifier endpoint, where unsanitized input to the dip_address and sip_address parameters permits OS command injection. The issue is tracked under CWE-77 and CWE-78, carries a CVSS 4.0 score of 6.9, and affects only devices that are no longer supported by the vendor.
An unauthenticated attacker can exploit the flaw remotely by sending crafted HTTP requests containing shell metacharacters in the affected parameters. Successful exploitation grants the ability to execute arbitrary operating-system commands on the device, potentially leading to configuration changes, traffic interception, or further lateral movement within the local network. Public proof-of-concept code has already been released.
The affected hardware reached end-of-support status prior to disclosure, and D-Link has not issued patches or mitigation guidance for this model. The associated EPSS score remains flat at 0.0673 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16942
Vulnerability details
A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to os command injection. The attack can be…
more
launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated OS command injection (CWE-78) in the router's public-facing web interface (/goform/qosClassifier) enables exploitation of public-facing applications (T1190) and indirect command execution via manipulated arguments (T1202).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.