cbcvebase.
CVE-2025-13188
published 2025-11-14

CVE-2025-13188: A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file…

PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.44%
82.5th percentile
A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file /authentication.cgi. Performing manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges
VendorProductVersion rangeFixed in
d-linkdir-816l——
dlinkdir-816l_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/authentication.cgi↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link authentication.cgi password Parameter Buffer Overflow Attempt (CVE-2025-13188)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/authentication.cgi|3f|"; startswith; fast_pattern; content:"password|3d|"; distance:0; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(authentication.cgi).pdf; reference:cve,2025-13188; classtype:web-application-attack; sid:2065796; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_11_17, cve CVE_2025_13188, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Look for HTTP GET requests to /authentication.cgi where the 'password' parameter value is 100 or more characters long — this is the overflow trigger pattern captured by the Snort PCRE `/^[^&]{100,}(?:&|$)/R`.
  • →Traffic is expected in plaintext (non-TLS); deploy detection at the network perimeter and internally on segments hosting D-Link DIR-816L devices.
  • →The exploit is publicly available; treat any matching traffic as high-severity and correlate with MITRE ATT&CK T1190 (Exploit Public-Facing Application) under tactic TA0001 (Initial Access).
  • →The vulnerable function is `authenticationcgi_main` in `/authentication.cgi`; stack-based buffer overflow is triggered via manipulation of the `Password` argument — focus endpoint monitoring on this CGI handler process.
  • ·This vulnerability only affects D-Link DIR-816L firmware version 2_06_b09_beta, which is end-of-life and will receive no vendor patch. Mitigation must be network-based (block/isolate the device) rather than firmware-based. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.