CVE-2025-5624
Published: 05 June 2025
Summary
CVE-2025-5624 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-5624 is a stack-based buffer overflow vulnerability in the QoSPortSetup function within the /goform/QoSPortSetup endpoint of the D-Link DIR-816 router running firmware version 1.10CNB05. The flaw is triggered by unsanitized input supplied to the arguments port0_group, port0_remarker, ssid0_group, and ssid0_remarker, and it is tracked under CWE-119, CWE-121, and CWE-787. The issue affects an end-of-life device that is no longer supported by the vendor.
The vulnerability can be exploited remotely by unauthenticated attackers over the network without user interaction. Successful exploitation grants an attacker the ability to overwrite stack memory, which may result in arbitrary code execution or a denial-of-service condition on the affected router.
The referenced advisories and disclosure materials, including the public GitHub proof-of-concept and Vuldb entries, note that the product is unsupported and do not describe any official patches or mitigation steps from D-Link. The EPSS score has remained flat at 0.0245 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16950
Vulnerability details
A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /goform/QoSPortSetup. The manipulation of the argument port0_group/port0_remarker/ssid0_group/ssid0_remarker leads to stack-based buffer overflow. The attack can be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack-based buffer overflow in the D-Link DIR-816 router's public-facing web interface (/goform/QoSPortSetup) enables exploitation of a public-facing application (T1190) for potential RCE and application/system exploitation leading to endpoint denial of service via server crash (T1499.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.