CVE-2016-5681

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 11.93%
EPSS Percentile: 96.10%
CISA KEV: Not listed

Description

Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Aug-2016 04:59
Last Modified: 17-Jun-2026 07:49
EPSS Date: 2026-10-29
CWE: CWE-119

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

dlink / dir-868l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 2.03
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*
dlink / dir-822_firmware Source: NVD CPE · affected
Version / affected range: 3.01
cpe:2.3:o:dlink:dir-822_firmware:3.01:*:*:*:*:*:*:*
d-link / dir-880l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 1.07
cpe:2.3:o:d-link:dir-880l_firmware:*:*:*:*:*:*:*:*
d-link / dir-850l_firmare Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 2.07
cpe:2.3:o:d-link:dir-850l_firmare:*:*:*:*:*:*:*:*
d-link / dir-895l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 1.11
cpe:2.3:o:d-link:dir-895l_firmware:*:*:*:*:*:*:*:*
d-link / dir-817l\(w\)_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) jul.2016
cpe:2.3:o:d-link:dir-817l\(w\)_firmware:*:*:*:*:*:*:*:*
d-link / dir-818l\(w\)_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 2.05
cpe:2.3:o:d-link:dir-818l\(w\)_firmware:*:*:*:*:*:*:*:*
d-link / dir-890l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 1.09
cpe:2.3:o:d-link:dir-890l_firmware:*:*:*:*:*:*:*:*
d-link / dir-823_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 1.00
cpe:2.3:o:d-link:dir-823_firmware:*:*:*:*:*:*:*:*
d-link / dir-885l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 1.11
cpe:2.3:o:d-link:dir-885l_firmware:*:*:*:*:*:*:*:*
dlink / dir-868l_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 3.00
cpe:2.3:o:dlink:dir-868l_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 30-Oct-2026 19:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

AryStinger exploits older flaws such as CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, targeting primarily D-Link DIR-850L, D-Link DIR-818LW routers. AryStinger Botnet Reportedly Compromises More Than 4,000 Routers

CVE (2)

Malware (2)

MITRE ATT&CK (3)

Vendors (1)

Products (2)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.