CVE-2025-13304

D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow

Published Nov 17, 2025 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Dlink
Dlink dir-825m
Dlink dir-825m Firmware
Dlink dwr-m920
Dlink dwr-m920 Firmware
Dlink dwr-m921
Dlink dwr-m921 Firmware
Dlink dwr-m960
Dlink dwr-m960 Firmware
Dlink dwr-m961
Dlink dwr-m961 Firmware
CPEs cpe:2.3:h:dlink:dir-825m:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dwr-m921:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dwr-m960:b1:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dwr-m961:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-825m_firmware:1.01.07:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dir-825m_firmware:1.1.47:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m920_firmware:1.01.07:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m920_firmware:1.1.47:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m921_firmware:1.01.07:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m921_firmware:1.1.47:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m960_firmware:1.01.07:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m960_firmware:1.1.47:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m961_firmware:1.01.07:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m961_firmware:1.1.47:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dir-825m
Dlink dir-825m Firmware
Dlink dwr-m920
Dlink dwr-m920 Firmware
Dlink dwr-m921
Dlink dwr-m921 Firmware
Dlink dwr-m960
Dlink dwr-m960 Firmware
Dlink dwr-m961
Dlink dwr-m961 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared D-link
D-link dir-825
D-link dwr-920
D-link dwr-921
D-link dwr-960
D-link dwr-961
Vendors & Products D-link
D-link dir-825
D-link dwr-920
D-link dwr-921
D-link dwr-960
D-link dwr-961
Type Values Removed Values Added
Description A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
Title D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}