Executive brief
A security vulnerability exists in the D-Link DIR-816A2 router, a device used to provide wireless internet connectivity for homes and small offices. The flaw occurs in the component responsible for handling firmware updates and system version information. If exploited, an attacker could take full control of the router, potentially leading to intercepted internet traffic, unauthorized access to the local network, or a complete disruption of service.
Technical details
A stack-based buffer overflow and command injection vulnerability exists in the upload.cgi module of D-Link DIR-816A2 firmware version 1.10CNB05. The vulnerability is located in the sub_401078 function, where the application reads the contents of /proc/version using fgets() into a 512-byte buffer and subsequently uses sprintf() to concatenate this data into another 512-byte buffer alongside a 29-byte constant string. Because the concatenation does not account for the constant's length, providing input exceeding 481 bytes triggers a stack overflow. Additionally, the lack of sanitization on the input passed to a system() call allows for command injection. An attacker who can control the content of /proc/version (typically requiring prior low-privileged access or a chained exploit) can achieve arbitrary code execution with the privileges of the web server.
Affected products
- D-Link DIR-816A2 DIR-816A2_FWv1.10CNB05_R1B011D88210.img
Timeline
- 2025-11-13: advisory: Initial disclosure by MITRE/NVD
- 2025-11-14: other: CISA-ADP assigned CVSS score and CWE-121