CVE-2025-5623
Published: 05 June 2025
Summary
CVE-2025-5623 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as critical has been identified in the D-Link DIR-816 router running firmware version 1.10CNB05. It resides in the qosClassifier function of the /goform/qosClassifier endpoint, where improper handling of the dip_address and sip_address arguments triggers a stack-based buffer overflow. The flaw is tracked under CWE-119, CWE-121, and CWE-787, carries a CVSS 4.0 score of 9.3, and affects only devices that are no longer supported by the vendor.
An unauthenticated attacker can exploit the issue remotely by sending crafted HTTP requests that overflow the stack buffer. Successful exploitation grants full control over the device, enabling arbitrary code execution with high impact to confidentiality, integrity, and availability. A public proof-of-concept has already been disclosed, making the attack practical for anyone with network access to the router's management interface.
No official patches are available because the product has reached end-of-life. The D-Link reference page and vulnerability databases list the device as unsupported, leaving administrators with only mitigation options such as network segmentation or device replacement. The EPSS score remains flat at 0.0362 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16940
Vulnerability details
A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been classified as critical. This affects the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to stack-based buffer overflow. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the unauthenticated web endpoint /goform/qosClassifier enables remote exploitation of the public-facing router application for potential code execution or denial of service.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.