CVE-2025-13191 is a high severity stack based buffer overflow (CVSS 8.8) in the D-Link DIR-816L router, firmware 2_06_b09_beta, in the soapcgi_main function of soap.cgi. The record says the product is no longer supported by the maintainer, so plan to replace the router rather than wait for a patch.
What's affected
The affected product is the D-Link DIR-816L router, listed in the record as version 2_06_b09_beta. The vulnerable function is soapcgi_main in soap.cgi.
The record carries a notable sentence: this vulnerability only affects products that are no longer supported by the maintainer. That means there is no fixed firmware to move to. Do not wait for one. The record also says the exploit has been publicly disclosed.
The weaknesses are CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack based buffer overflow). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, low privileges, and a high impact on confidentiality, integrity and availability. The kev flag is false.
How to check if you're exposed
Identify routers first. Check the label on the device, or the admin page, for the model name DIR-816L and the firmware string. If you manage many sites, query your asset inventory for the model.
From a machine on the same network, you can see whether the management interface answers and what it reports about itself, then compare with the firmware string in the record. If the router exposes its web or UPnP services on the WAN side, the exposure is worse, so check that too.
# from outside your network, see whether common management ports answer on your public address
nmap -Pn -p 80,443,8080,49152 YOUR.PUBLIC.IP
Only scan addresses you own. If the ports answer, the device is reachable from the internet and moves up your list.
What to do now
- List every DIR-816L you run, at offices, branch sites and staff homes if you manage them.
- Plan replacement with a model that still receives security updates. The record says this one will not.
- Until it is replaced, turn off remote administration and any services exposed to the internet side.
- Put the router behind another firewall if you can, and keep it off any network that holds sensitive systems.
- Change the admin password and keep the default credentials out of use.
- Segment guest and IoT devices from business machines.
- Add the model to your end of life list so it is flagged in future hardware reviews.
Why it matters
A stack based buffer overflow happens when a program copies more data into a fixed size memory area than it can hold, and the extra data overwrites neighbouring memory. These bugs are a long running source of router flaws because the code is written in C, runs with high privileges, and often parses data straight from the network. The two weakness classes in the record, CWE-119 and CWE-121, describe that pattern.
End of life gear is the harder part. A supported product gets a patch and a version number to track. An unsupported one gets neither, so the risk stays open for as long as the device stays online. The honest fix is replacement, and the sooner it is scheduled the better.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported by the maintainer, so a fix should not be expected. Check D-Link's own notice if you need a formal statement.
Is it enough to disable remote administration?
It lowers exposure from the internet but does not fix the flaw. The vector shows a low privilege account is needed, and anything on the local network may still reach the device. Replacement is the real fix.
Sources
- Safeguard Gold entry for CVE-2025-13191
- https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(soap.cgi).pdf
- https://vuldb.com/?ctiid.332480
- https://vuldb.com/?id.332480
- https://vuldb.com/?submit.685543
Last reviewed: 19 October 2026.
