CVE-2025-13188CWE-119CWE-121

CVE-2025-13188

Critical · published November 15, 2025

CVSS v3.1
9.8
EPSS
2%
Percentile
83.8
In the wild
Unconfirmed
What it is

🚨 A small tweak in the Password argument can unleash a stack-based buffer overflow in D-Link DIR-816L devices — your router could become a hacker's playground! 🔥 Think of it like a poorly secured restaurant where anyone could slip a fake order into the kitchen, overwhelming the staff with unwanted dishes. If the staff isn't careful, it could lead to chaos in the back! An attacker could exploit this vulnerability to execute malicious code remotely, potentially compromising your entire network. Since this flaw affects unsupported products, many users may not even be aware they're at risk, leaving their devices wide open for exploitation. This could lead to unauthorized access and serious data breaches.

Put simply

Think of it like a poorly secured restaurant where anyone could slip a fake order into the kitchen, overwhelming the staff with unwanted dishes. If the staff isn't careful, it could lead to chaos in the back! This CVE allows for a stack-based buffer overflow through manipulation of the Password argument within the /authentication.cgi file of the D-Link DIR-816L firmware. The overflow can lead to remote code execution with the right conditions, putting users at significant risk.

What to do

An attacker could exploit this vulnerability to execute malicious code remotely, potentially compromising your entire network. Since this flaw affects unsupported products, many users may not even be aware they're at risk, leaving their devices wide open for exploitation. This could lead to unauthorized access and serious data breaches. Immediately consider replacing the affected D-Link DIR-816L device with a supported model. If replacement isn't feasible, ensure your network is isolated and monitor for any suspicious activity. Regularly check for firmware updates, though this specific model is no longer supported and unlikely to receive any. You've got this! Protecting your network is within reach — just take these steps to keep everything secure! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02386 · 83.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-11-15T04:15Z
Affected products (1)
ProductVersionsFixed in
dlink/dir-816l_firmwareall versions—
References (6)
EPSS history
Timeline
  • 14 NOV 22:32Z
    D-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow
    cvelistv5