CVE-2025-5622

The vulnerability affects the wirelessApcli_5g function handled by the /goform/wirelessApcli_5g endpoint. Manipulation of the apcli_mode_5g, apcli_enc_5g, or apcli_default_key_5g parameters causes a stack-based buffer overflow — user-supplied data is copied to a stack buffer without proper length verification. The attack can be conducted remotely over the network, and the exploit has been publicly disclosed and may be actively exploited.

An attacker can achieve arbitrary code execution on the device (RCE), gain complete control over the router, or cause it to crash. Due to the lack of authentication requirements, this vulnerability poses a serious threat to all devices accessible from the network.

D-Link has not issued and does not plan to issue a patch, as the product has reached End-of-Life status. It is recommended to immediately remove the device from service and replace it with an actively supported model. As interim measures, restrict access to the administrative interface only to trusted local networks and disable remote management on the device.

D-Link DIR-816 with firmware version 1.10CNB05. The device is no longer supported by the manufacturer.