Dir 825 Firmware CVE-2025-6292

While the CVSS 3.1 score of 8.8 is high, real-world risk must be contextualized: (1) Attack Vector (Network): Remotely exploitable without physical access—favorable for attackers. (2) Privileges Required (Low): Requires valid authentication, raising the bar compared to unauthenticated RCE but still exploitable by authorized users, malicious ISP staff, or attackers with compromised credentials. (3) User Interaction (None): No social engineering needed once authenticated. (4) Scope (Unchanged) and Confidentiality/Integrity/Availability (High): Full system compromise is possible. (5) Exploitation Status: Public POC disclosure significantly increases exploitation probability; EPSS scoring would likely be in the 70-90% range given disclosure and end-of-life status. (6) KEV Likelihood: Given active exploitation potential and public POC, this may be in CISA KEV catalog. (7) Automatable: Stack overflow exploitation is technique-sensitive and typically requires custom crafting per firmware version, reducing pure automation probability but not eliminating it. Risk Priority: This is a genuine priority for organizations still deploying DIR-825 routers in production (corporate networks, SMBs, ISPs). However, the end-of-life status and authentication requirement mean it's lower priority than unauthenticated RCEs affecting current-generation products. For legacy networks, this demands immediate remediation (device replacement or network segmentation).

An authenticated attacker (e.g., a disgruntled employee with router admin credentials, or an attacker who has compromised credentials through phishing/credential stuffing) logs into the router's web management interface or uses the HTTP API with valid credentials. The attacker crafts a malicious HTTP POST request with an oversized parameter (e.g., an excessively long string in a configuration field like SSID, WPA password, or device name) targeting the vulnerable sub_4091AC function. The oversized input overflows the stack buffer, corrupting a return address or saved frame pointer. The attacker carefully constructs the payload (using publicly available POC) to inject and execute shellcode that grants them root-level access to the router. Once compromised, the attacker can: (a) modify firewall rules to intercept traffic, (b) perform man-in-the-middle attacks on all connected clients, (c) harvest credentials from connected devices, (d) use the router as a pivot point to attack internal networks behind it, or (e) turn the router into a botnet node. Real-world likelihood: Moderate to high for legacy networks still using DIR-825 units, especially in environments with shared/weak credential hygiene. Low for organizations that have upgraded to current-generation equipment.