CVE-2025-5620 is a high severity command injection flaw (CVSS 7.3) in D-Link DIR-816 firmware 1.10CNB05. It is reachable over the network and needs no account. The record says the product is no longer supported, so replace the device or take it off any untrusted network.
What's affected
The record lists D-Link DIR-816 firmware 1.10CNB05. The affected code is the function setipsec_config in /goform/setipsec_config, and the argument localIP and remoteIP is the one the flaw depends on.
The NVD description was published on 2025-06-05. NVD rates it HIGH with a base score of 7.3. The vector shows attack complexity low, no user interaction, and impact of confidentiality low, integrity low, availability low.
Fixed versions: none. The record states that the vulnerability only affects products that are no longer supported by the maintainer. Treat any exposed unit as permanently at risk unless you can confirm otherwise from the vendor's own notice.
The record also says the exploit has been disclosed to the public and may be used. It is not marked as exploited in the wild: the CISA Known Exploited Vulnerabilities flag in the record is false.
How to check if you're exposed
Open the router's web interface and read the firmware version on the status page. The record names firmware 1.10CNB05. Also confirm the model, since the record covers the D-Link DIR-816 only.
Then check whether the management interface is reachable from the internet. From a machine outside your network, a connection attempt to the router's public address on its web management port should fail. If remote administration is switched on, turn it off in the settings now.
What to do now
- Identify every D-Link DIR-816 you run and write down its location and firmware version.
- Switch off remote administration and any port forwarding that points at the device.
- Check the vendor's support page for a notice about this CVE. The record says the product is out of support, so do not wait for a patch.
- Plan a replacement with a model that still receives updates, and move it up the list if the unit sits at the edge of a network.
- Place the device on its own segment until it is replaced, and watch for unexpected configuration changes.
Why it matters
This is command injection. The classes are CWE-77 (command injection); CWE-78 (OS command injection). A web form handler in the router passes the value of localIP and remoteIP toward an operating system command without enough checking. Input that was meant to be a plain network value can end up interpreted as part of a command.
On a router, the command runs with the rights of the device's management process, which is usually root. That is why such flaws on consumer and small office gear matter even at a score of 7.3. A compromised router sees and can alter the traffic of everything behind it.
The record says the product is out of support. That turns a patching question into a replacement question.
Quick check
Does turning off remote administration remove the risk?
It removes the internet facing path, which matters most. Anyone on the local network may still reach the web interface, so keep that segment trusted.
Is there a firmware fix?
The record does not name one. Check the vendor's support site and confirm the version in writing if you can.
Sources
Check your own dependencies with the free in-browser scan at gold.safeguard.sh/scan. It reads manifests you give it, so it will not see a router or a standalone server, but it is a quick way to cover the code you ship.
Last reviewed: 18 October 2026.
