Vulnerability Description
A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dir-816 Firmware | 1.10cnb05_r1b011d88210 |
| Dlink | Dir-816 | a2 |
Related Weaknesses (CWE)
References
- http://d-link.comProduct
- https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVEExploitThird Party Advisory
- https://www.dlink.com/enProduct
- https://www.dlink.com/en/security-bulletin/Vendor Advisory
FAQ
What is CVE-2025-60679?
CVE-2025-60679 is a vulnerability with a CVSS score of 8.8 (HIGH). A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The v...
How severe is CVE-2025-60679?
CVE-2025-60679 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-60679?
Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-816 Firmware, Dlink Dir-816.