CVE-2025-13191
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
A vulnerability was found in D-Link DIR-816L version 2_06_b09_beta in the soapcgi_main function of /soap.cgi, causing a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer.
Risk Assessment
A remote attacker could exploit the buffer overflow to destabilize the device or potentially execute code. Since the product is no longer supported, no official fix should be expected.
Recommendation
Replace the D-Link DIR-816L with a newer, supported model or isolate it from internet access. Do not rely on patching, as the product is no longer maintained.
Other vulnerabilities in D-Link DIR-816L
See all- CVE-2025-13188Critical
D-Link DIR-816L version 2_06_b09_beta contains a stack-based buffer overflow vulnerability in the function authenticationcgi_main of the file /authentication.cgi. Manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation is possible, and the exploit is public. This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2025-9727Medium
A weakness was identified in D-Link DIR-816L version 206b01 in the soapcgi_main function of /soap.cgi. Manipulating the service argument leads to OS command injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2025-13190High
D-Link DIR-816L 2_06_b09_beta is affected by a stack-based buffer overflow in the scandir_main function of /portal/__ajax_exporer.sgi via manipulation of the en argument. The attack can be performed remotely and a public exploit exists.
- CVE-2025-13189High
A vulnerability was found in D-Link DIR-816L version 2_06_b09_beta in the genacgi_main function of gena.cgi. Manipulation of the SERVER_ID/HTTP_SID arguments leads to a stack-based buffer overflow. The attack can be carried out remotely, the exploit has been publicly disclosed, and the vulnerability only affects products no longer supported by the maintainer.
Original NVD description (English source)
A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta. This issue affects the function soapcgi_main of the file /soap.cgi. This manipulation causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS