D-Link DIR-825 CVE-2026-7068

Exploitation requires attacker presence on the same Layer 2 broadcast domain as the vulnerable DIR-825 router (AV:A - Adjacent Network attack vector). Specifically, the attacker must reach the router's NetBIOS service listening on UDP ports 137/138, which is typically accessible only from the local network segment, not across routed boundaries. No authentication is required (PR:N) and exploitation works against default configurations with NetBIOS services enabled. User interaction is not needed (UI:N). The limiting factor protecting most deployments is network topology - internet-based attackers cannot reach the vulnerable service unless the router is misconfigured with NetBIOS ports forwarded from WAN (extremely rare). However, any device on the local WiFi or wired LAN - including compromised IoT devices, malicious guests, or attackers with physical proximity to WiFi networks - meets the adjacency requirement.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. CVSS 4.0 score of 7.4 with vector AV:A (Adjacent Network)/AC:L (Low Complexity)/PR:N (No Privileges)/VC:H/VI:H/VA:H indicates high impact but limited attack surface - exploitation requires attacker presence on the same local network segment (WiFi or wired LAN), not remote internet access. EPSS score of 0.03% (7th percentile) suggests minimal broad exploitation activity despite public POC availability, likely because the attack vector (adjacent network) limits scalability compared to internet-facing vulnerabilities. SSVC assessment confirms POC existence but rates automatable as 'no' due to adjacent network requirement and technical impact as 'total' given complete device compromise potential. The critical risk factor is end-of-life status: no vendor patch will ever be released, making this a permanent vulnerability in deployed devices. Priority depends on deployment context - home/SOHO environments with trusted local networks face lower immediate risk, while devices in guest WiFi scenarios or shared network environments face higher threat from malicious insiders or compromised adjacent systems. This is a 'replace hardware' scenario rather than 'patch and monitor' situation.

An attacker connects to the target network as a guest WiFi client or compromises any device on the local LAN segment. They send crafted NetBIOS name service packets to UDP port 137/138 targeting the DIR-825's IP address, triggering the buffer overflow in the NMBD_process function. The public POC referenced at tzh00203.notion.site provides exploitation details. Successful exploitation grants arbitrary code execution with root privileges, allowing complete router takeover, network traffic interception, DNS hijacking, or pivoting to attack other LAN devices.