{"id":"CVE-2025-60679","aliases":["EUVD-2025-175369","GHSA-xhj4-39f6-qqcq"],"status":"published","title":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR...","description":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00714,"percentile":0.5394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2025-11-13T00:00:00Z","modified":"2026-07-05T02:17:11Z","products":[{"vendor":"dlink","product":"dir-816_firmware"}],"references":[{"url":"https://www.dlink.com/en/security-bulletin/","tags":["Vendor Advisory"]},{"url":"https://www.dlink.com/en","tags":["Product"]},{"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVE-2025-60679.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60679"},{"url":"https://www.dlink.com/en/security-bulletin"},{"url":"http://d-link.com"},{"url":"https://github.com/advisories/GHSA-xhj4-39f6-qqcq"}],"sources":{"cve":[{"id":"CVE-2025-60679","description":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.","status":"published","published":"2025-11-13T00:00:00Z","modified":"2026-07-05T01:19:05.27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-175369","description":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.","status":"published","published":"2025-11-13T00:00:00Z","modified":"2026-07-05T01:19:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:15.276406Z"}],"ghsa":[{"id":"GHSA-xhj4-39f6-qqcq","title":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR...","description":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.","status":"published","published":"2025-11-13T21:31:19Z","modified":"2025-11-14T18:31:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:04:48.557805Z"}],"nvd":[{"id":"CVE-2025-60679","description":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.","status":"published","published":"2025-11-13T20:15:51.42Z","modified":"2026-07-05T02:17:11.747Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:44.669367Z"}]}}