The vulnerability resides in the NTP Service component of certain D‑Link routers and allows remote attackers to execute arbitrary operating‑system commands. It is triggered when the handler_update_system_time function in libdeuteron_modules.so forwards untrusted data to a system call without proper sanitization, a flaw that corresponds to CWE‑77 and CWE‑78. If exploited, an attacker could gain full control of the device, enabling data exfiltration, configuration changes, and the use of the router as a foothold for further network attacks.

The affected units are D‑Link DIR‑825 and DIR‑825R running firmware versions 1.0.5 and 4.5.1. These firmware releases are no longer supported by the vendor, meaning no official patch or security update is available for these legacy devices.

With a CVSS score of 8.6 the vulnerability is considered high risk and can be accessed remotely without authentication. No exploit intelligence places it in the CISA KEV catalog, and EPSS data is not available, but the lack of a vendor fix combined with the remaining public exposure of the devices raises the likelihood of real‑world exploitation.