CVE-2025-45931 is a remote code execution vulnerability in the D-Link DIR-816-A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210. The issue arises from improper handling of input to the system() function within the bin/goahead executable, enabling an unauthenticated attacker to execute arbitrary commands remotely. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker to execute arbitrary code on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, disruption of network services, and further attacks on connected networks or devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, affected users should consider disabling remote management features if possible and restrict network access to the device. Monitor vendor communications for updates and apply official patches promptly once released.