Executive brief
A security vulnerability exists in the D-Link DIR-816 router, a device used to provide internet connectivity and manage home or small office networks. An attacker can exploit a flaw in the port forwarding settings to inject malicious commands into the device's operating system. If successful, this allows the attacker to gain unauthorized control over the router, potentially leading to intercepted traffic, network disruptions, or further attacks on connected devices.
Technical details
A stored command injection vulnerability exists in the D-Link DIR-816 router (firmware version 1.10CNB05_R1B011D88210) within the /goform/singlePortForward endpoint. The vulnerability is rooted in the sub_445E7C function, which performs insufficient validation on the 'ip_address' parameter using only inet_aton(). This allows a malicious string to be saved into the 'SinglePortForwardRules' NVRAM variable. When these rules are subsequently applied, the sub_448A34 function retrieves the stored value and passes it to sub_447560, which constructs an iptables DNAT command. Because the input is not escaped before being passed to doSystem(), an attacker with low privileges can execute arbitrary shell commands with the permissions of the web process.
Affected products
- D-Link DIR-816 1.10CNB05_R1B011D88210
Timeline
- 2026-05-11: advisory: NVD publication date