Dir 825 CVE-2026-4627

D-Link DIR-825 or DIR-825R firmware versions 1.0.5/4.5.1. Requires authenticated access with high-privilege administrative credentials to the NTP Service configuration. Remote attacker must have admin-level authentication to manipulate the system time handler function in libdeuteron_modules.so.

The CVSS 3.1 score of 7.2 (High) reflects a network-accessible attack vector with low complexity, but critically requires high privileges (PR:H) and produces high impact across confidentiality, integrity, and availability. While the network attack vector (AV:N) is concerning, the high privilege requirement significantly limits the attack surface to authenticated administrators or compromised accounts with elevated access. The real-world risk is substantially elevated by three factors: these are end-of-life products with no patch forthcoming, they are consumer routers often deployed with default credentials, and the VulDB submission suggests active research interest. However, the privilege requirement means this is not a wormable or mass-exploitation threat. Organizations should prioritize replacement over mitigation given the EOL status, but this is not a drop-everything emergency unless these specific models are internet-facing with administrative interfaces exposed.

An attacker who has obtained administrative credentials to the D-Link router (through credential stuffing, default password usage, or prior compromise) authenticates to the web management interface over the network. The attacker navigates to the NTP configuration settings and crafts a malicious time server address or NTP-related parameter containing shell metacharacters and command sequences. When the router processes this input through the vulnerable handler_update_system_time function in libdeuteron_modules.so, the injected commands execute with root privileges, allowing the attacker to install persistent backdoors, intercept network traffic, or pivot to other devices on the network.