What is the CVSS score of CVE-2025-6328?

CVE-2025-6328 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Dir 815 Firmware are affected by CVE-2025-6328?

A publicly disclosed remote code execution vulnerability affects D-Link DIR-815 wireless routers with no patch currently available.

Is there a public PoC exploit available for CVE-2025-6328?

Yes, a public proof-of-concept exploit is available for CVE-2025-6328. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6328?

Within 24 hours: Inventory all D-Link DIR-815 devices running firmware 1.01 and isolate them from critical network segments. Within 7 days: Either upgrade to an alternative router model or implement strict network access controls limiting management access to these devices. Within 30 days: Complete replacement of affected devices with patched alternatives or establish permanent compensating controls if replacement is not feasible.

Dir 815 Firmware CVE-2025-6328

EUVD-2025-18734 HIGH

Buffer Overflow (CWE-119)

2025-06-20 cna@vuldb.com

RCE Buffer Overflow D-Link Dir 815 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18734

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jul 11, 2025 - 15:52 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 10:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in D-Link DIR-815 1.01. It has been declared as critical. This vulnerability affects the function sub_403794 of the file hedwig.cgi. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical stack-based buffer overflow vulnerability exists in D-Link DIR-815 firmware version 1.01 within the hedwig.cgi module (function sub_403794), allowing remote attackers with low privilege access to execute arbitrary code with high impact on confidentiality, integrity, and availability. Public exploit code is available and the vulnerability may be actively exploited in the wild, making this a high-priority remediation target.

Technical ContextAI

The vulnerability is a stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the hedwig.cgi web interface of D-Link DIR-815 routers. The affected function sub_403794 fails to properly validate input boundaries when processing user-supplied data, resulting in stack memory corruption. D-Link DIR-815 is a wireless router commonly used in enterprise and home environments; hedwig.cgi is a CGI script handling device management functions. The vulnerability affects CPE: cpe:2.3:o:d-link:dir-815_firmware:1.01:*:*:*:*:*:*:*. Buffer overflows in router management interfaces are particularly dangerous as they operate at system privilege level and can lead to complete device compromise.