Executive brief
A security vulnerability exists in the D-Link DIR-816 router, a device used to provide internet connectivity and networking for homes and small offices. An attacker with access to the router's management interface can inject malicious commands into the device's configuration. If exploited, this could allow the attacker to take control of the router, potentially leading to intercepted internet traffic or a complete loss of network service.
Technical details
A command injection vulnerability exists in the D-Link DIR-816 router (firmware version 1.10CNB05_R1B011D88210) within the /goform/formDMZ.cgi component. The function sub_445E7C fails to properly sanitize the 'DMZIPAddress' parameter, relying on inet_aton() which does not filter shell metacharacters. The unsanitized input is stored in NVRAM and subsequently retrieved by sub_447C28, where it is formatted into an iptables command via snprintf() and executed using doSystem(). An authenticated attacker can exploit this by submitting a crafted DMZ configuration and triggering a firewall refresh, resulting in arbitrary command execution with system privileges.
Affected products
- D-Link DIR-816 1.10CNB05_R1B011D88210
Timeline
- 2026-05-11: advisory: Initial disclosure by VulDB and NVD