Which versions of D-Link DIR-825 are affected by CVE-2026-7068?

CVE-2026-7068 is a critical stack-based buffer overflow in D-Link DIR-825 routers (firmware 3.00b32) that allows unauthenticated adjacent network attackers to completely compromise affected devices.

How to fix or mitigate CVE-2026-7068?

Within 24 hours: Identify and inventory all D-Link DIR-825 devices running firmware 3.00b32 across the network. Within 7 days: Implement network segmentation to isolate affected routers from sensitive systems and restrict access to trusted networks only. Within 30 days: Replace DIR-825 units with currently-supported router models receiving active vendor security updates, or decommission if no longer operationally necessary.

D-Link DIR-825 CVE-2026-7068

Q: What is the CVSS score of CVE-2026-7068?

CVE-2026-7068 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Buffer Overflow (CWE-119)

2026-04-27 cna@vuldb.com

Buffer Overflow D-Link

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:28 vuln.today

v2 (cvss_changed)

CVSS changed

Apr 29, 2026 - 01:12 NVD

8.7 (HIGH) 7.4 (HIGH)

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 00:29 vuln.today

Analysis Generated

Apr 27, 2026 - 00:22 vuln.today

CVE Published

Apr 27, 2026 - 00:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer overflow. The attack can only be initiated within the local network. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in D-Link DIR-825 firmware 3.00b32's nmbd NetBIOS service allows adjacent network attackers to achieve complete device compromise without authentication. Public exploit code exists (SSVC: POC confirmed), though EPSS probability remains low (0.03%, 7th percentile) indicating limited observed exploitation attempts. This vulnerability affects end-of-life hardware no longer receiving vendor security updates, creating permanent risk for deployed devices.

Technical ContextAI

The vulnerability resides in the NMBD_process function within sserver.c of the nmbd daemon (NetBIOS Name Service), a component inherited from Samba used for Windows network browsing and name resolution on D-Link routers. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates insufficient bounds checking when processing NetBIOS name service packets over UDP port 137/138. The affected firmware version 3.00b32 for DIR-825 hardware revision (specific revision not provided in CPE data) contains this flawed implementation in the embedded network services stack.

RemediationAI

No vendor-released patch exists or will be developed for this end-of-life product. Recommended actions in order of effectiveness: (1) Replace DIR-825 hardware with currently-supported router models receiving active security updates - this is the only permanent solution. (2) If immediate replacement is infeasible, disable NetBIOS services in router administration interface if configurable, though this may break Windows network browsing for some legacy devices (trade-off: reduced LAN discoverability). (3) Implement network segmentation by isolating DIR-825 on dedicated VLAN with restrictive firewall rules preventing cross-VLAN traffic, and never allow untrusted devices (guest WiFi clients) on same broadcast domain as the vulnerable router's management interface (trade-off: increased configuration complexity, requires managed switch). (4) Deploy network intrusion detection monitoring UDP ports 137-138 for malformed NetBIOS packets targeting the router's IP address (trade-off: detection without prevention). None of these mitigations eliminate the vulnerability - hardware replacement is the definitive solution.