CVE-2025-5623

The vulnerability exists in the qosClassifier function handling the /goform/qosClassifier endpoint. Manipulation of the dip_address or sip_address arguments allows for stack-based buffer overflow. By providing appropriately crafted input data, an attacker can overwrite stack memory areas, leading to hijacking control of program execution flow. The attack requires no privileges or user interaction.

An attacker can gain full control over the device, potentially executing arbitrary code (RCE) with the privileges of the process handling the request. Complete disabling of device functionality (denial of service) is also possible.

D-Link manufacturer does not plan to release a patch because the product has reached end-of-life support. Immediate replacement with a currently supported model is recommended. As an interim measure, the device should be isolated from the Internet, remote access to the administrative panel should be disabled, and access to the management interface should be restricted to trusted hosts only using a firewall.

D-Link DIR-816 with firmware version 1.10CNB05. The manufacturer no longer provides support for this product.