PT-2025-47045 · D Link · Dir-816

Lexpl0It · Published 2025-10-30 · Updated 2025-11-20 · CVE-2025-13190

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-816L version 2 06 b09 beta

Description A stack-based buffer overflow exists in the scandir main function of the /portal/ ajax exporer.sgi file. This flaw can be exploited remotely. The argument en can be manipulated to trigger the overflow. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2025-14393

CVE-2025-13190

Affected Products

Dir-816

References · 15

• 🔥 https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(scandir.sgi).pdf · Exploit
• https://bdu.fstec.ru/vul/2025-14393 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13190 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13190 · Vendor Advisory
• https://twitter.com/CVEnew/status/1989592790658159017 · Twitter Post
• https://t.me/cveNotify/142909 · Telegram Post
• https://vuldb.com/?submit.685541 · Note
• https://twitter.com/CveFindCom/status/1989599388671287331 · Twitter Post
• https://twitter.com/cracbot/status/1991461571315527963 · Twitter Post
• https://vuldb.com/?id.332479 · Note
• https://vuldb.com/?ctiid.332479 · Note
• https://t.me/CVEtracker/37412 · Telegram Post
• https://t.me/cveNotify/143442 · Telegram Post
• https://twitter.com/CveTodo/status/1989596321032863806 · Twitter Post
• https://dlink.com · Note