D-Link DIR-825 CVE-2026-7069

Attacker must have adjacent network access (AV:A), meaning physical presence on the same network segment as the vulnerable router via WiFi association or wired Ethernet connection. Low-privilege authentication (PR:L) to the local network is required - the attacker needs valid network credentials to join the LAN but does not need router administrative access. The vulnerable miniupnpd service must be enabled on the router (UPnP is commonly enabled by default on consumer routers but can be disabled via admin interface). Exploitation is limited to D-Link DIR-825 devices running firmware 3.00b32 or earlier. Attack does not work remotely over the internet (AV:A excludes network-based attacks) and requires no user interaction (UI:N). The adjacent-network requirement significantly limits exploitation to scenarios where attackers have already breached the network perimeter or are malicious insiders.

Real-world risk is compartmentalized by attack surface constraints despite high technical impact. CVSS 4.0 vector (AV:A/AC:L/PR:L) indicates adjacent network access and low-privilege authentication are required - attackers must already be on the local network (WiFi or wired LAN) with valid credentials. This substantially limits exposure compared to internet-facing vulnerabilities. The EPSS score of 0.03% (7th percentile) confirms minimal observed exploitation activity, aligning with the adjacent-network prerequisite that restricts attack scope to insider threats or compromised LAN clients. SSVC framework categorizes this as POC exploitation with non-automatable attack (requires custom targeting) but total technical impact (full device compromise). No CISA KEV listing exists. Critical limiting factor: the product is end-of-life with no vendor support, meaning organizations still deploying DIR-825 routers face permanent exposure. The publicly available POC raises risk for targeted attacks against organizations known to use legacy D-Link infrastructure, but the adjacent-network requirement prevents mass internet scanning exploitation.

An attacker who has gained access to the local network (either by compromising a workstation on the LAN, connecting to the WiFi with valid credentials, or physically accessing an Ethernet port) crafts a malicious UPnP SOAP request targeting the router's miniupnpd service. The attacker sends an AddPortMapping command with an oversized NewPortMappingDescription parameter, triggering the stack-based buffer overflow in upnpsoap.c. Successful exploitation overwrites return addresses on the stack, allowing arbitrary code execution with the privileges of the miniupnpd daemon (typically root), resulting in complete router compromise. Public exploit code documented at https://tzh00203.notion.site/D-Link-DIR-825-miniupnpd-AddPortMapping-Stack-Overflow-337b5c52018a8028988ecc9daded409e demonstrates the attack feasibility.