External risk intelligence

D-Link DIR-816 Firmware Code Execution via system() Function

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-45931

This vulnerability affects a D-Link router firmware. Consumer routers are commonly deployed as internet-facing gateways and edge services, making their management interfaces or web-based services frequently reachable from the public internet.

Dlink Dir 816 Firmware

1.10cnb05_r1b011d88210

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in D-Link DIR-816 router firmware that could allow an unauthenticated remote attacker to execute arbitrary code. This issue stems from the use of a system() function within the bin/goahead file. The attack vector is network-based, meaning exploitation can occur over the internet.

Remote code execution risk in router firmware.
Routers are common internet gateways.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network could leverage this vulnerability by sending specially crafted requests to the router. This could allow them to execute arbitrary commands on the device by interacting with the `system()` function within the `bin/goahead` file.

No authentication required for access.
Triggered by sending crafted network requests.
Potential for full device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected device through the `system()` function within the `bin/goahead` file. This could potentially compromise the device's integrity and functionality.

Device firmware and services at risk.
Remote code execution via the `system()` function.
Complete device compromise and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in D-Link router firmware, allowing remote code execution, likely impacts consumer or small business network perimeters. Network or security teams typically manage these devices, and their first step should be to inventory all deployed D-Link DIR-816 routers, confirm their external reachability and business criticality, and then coordinate remediation efforts.

Network/Security teams should own remediation.
Verify device inventory and external exposure.
Plan risk-based maintenance for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-816 and its firmware?

The D-Link DIR-816 is a networking device that acts as a router, providing internet connectivity for home or small business networks. Its firmware is the core, low-level software embedded within the device that manages its routing functions, security settings, and web-based administrative interface, allowing users to control how data moves between their local devices and the wider internet.

What does CVE-2025-45931 mean by command execution?

This vulnerability is classified as CWE-77, which refers to improper neutralization of special elements used in a command. In this CVE, the router incorrectly handles certain inputs before passing them to a system function. Essentially, an attacker can input specific commands that the device mistakenly executes as if they were legitimate system instructions, potentially granting them full control over the device.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network requests to the router. Because the vulnerability exists within the bin/goahead file, it requires interacting with the web services that the router hosts. Please note that simply using the router for standard web browsing does not trigger this issue; it requires deliberate, malicious network traffic aimed at exploiting the underlying command-handling logic.

Is my D-Link DIR-816 at risk of being attacked?

Halo Surface Signal indicates that because this device is a router typically used as an internet-facing gateway, it is often directly reachable from the public internet. This high visibility means that if your device is running the affected firmware version, it is susceptible to remote attacks. Devices that are not exposed to the internet face a lower risk, but remain vulnerable to local network threats.

What should I do if I use this D-Link router?

First, identify if you have any D-Link DIR-816 units in your environment and confirm if they are running the specified vulnerable firmware version. Prioritize checking devices that are directly connected to the internet. Once identified, evaluate the criticality of those devices and coordinate a plan to update the firmware or restrict their access from the public internet until a permanent fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.