PT-2025-46900 · D Link · D-Link Dir-816 A2

Published 2025-11-13 · Updated 2025-11-14 · CVE-2025-60679

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-816A2 router firmware versions prior to DIR-816A2 FWv1.10CNB05 R1B011D88210

Description A stack buffer overflow condition exists in the D-Link DIR-816A2 router firmware. The issue is located in the upload.cgi module, which processes firmware version information. The vulnerability arises from reading the contents of /proc/version into a 512-byte buffer and then concatenating it with a 29-byte constant into another 512-byte buffer using the sprintf() function. Input exceeding 481 bytes in length causes a stack buffer overflow. An attacker controlling the content of /proc/version could potentially execute arbitrary code on the device.

Recommendations Update the firmware to version DIR-816A2 FWv1.10CNB05 R1B011D88210 or a later version.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2025-14838

CVE-2025-60679

Affected Products

D-Link Dir-816 A2

References · 9

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVE-2025-60679.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60679 · Security Note
• https://bdu.fstec.ru/vul/2025-14838 · Security Note
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60679 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1989235576453636508 · Twitter Post
• http://d-link.com · Note
• https://t.me/CVEtracker/37278 · Telegram Post
• https://dlink.com/en · Note