CVE-2025-5630
Published: 05 June 2025
Summary
CVE-2025-5630 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A stack-based buffer overflow vulnerability exists in the D-Link DIR-816 router running firmware version 1.10CNB05. The flaw is located in the /goform/form2lansetup.cgi endpoint and is triggered by manipulation of the ip argument, leading to memory corruption conditions tracked as CWE-119, CWE-121, and CWE-787. It affects an unsupported product line and received a CVSS 4.0 score of 9.3.
Unauthenticated attackers can exploit the issue remotely by sending crafted HTTP requests to the CGI script, achieving full control over the device or causing denial of service. An exploit has already been published and is available for use.
The device is explicitly noted as end-of-support, so no vendor patches or official mitigations are provided. Public references include a detailed disclosure on GitHub along with entries on Vuldb.
The associated EPSS score has remained flat at 0.0245 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16952
Vulnerability details
A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated stack-based buffer overflow in the public-facing web CGI endpoint (/goform/form2lansetup.cgi) enables remote code execution on the end-of-life D-Link DIR-816 router.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.