Which versions of D-Link DIR-825 are affected by CVE-2026-7069?

D-Link DIR-825 routers contain a buffer overflow vulnerability in the UPnP service that allows authenticated network attackers to completely compromise affected devices.

Is there a public PoC exploit available for CVE-2026-7069?

Yes, a public proof-of-concept exploit is available for CVE-2026-7069. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7069?

Within 24 hours: Inventory all DIR-825 routers in your network and document firmware versions. Within 7 days: Disable UPnP/miniupnpd service on all DIR-825 devices via administrative interface, or isolate affected routers to restricted network segments with no sensitive traffic. Within 30 days: Execute equipment replacement plan to migrate DIR-825 routers to current D-Link models or alternative vendors receiving active security updates; DIR-825 is end-of-life and will not receive patches.

D-Link DIR-825 CVE-2026-7069

Q: What is the CVSS score of CVE-2026-7069?

CVE-2026-7069 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25744 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-27 VulDB

Buffer Overflow D-Link Dir 825 D-Link

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:08 vuln.today

Public exploit code

Analysis Updated

Apr 29, 2026 - 01:29 vuln.today

v2 (cvss_changed)

CVSS changed

Apr 29, 2026 - 01:12 NVD

8.6 (HIGH) 7.3 (HIGH)

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 00:29 vuln.today

CVSS changed

Apr 27, 2026 - 00:22 NVD

8.0 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 00:15 euvd

EUVD-2026-25744

Analysis Generated

Apr 27, 2026 - 00:15 vuln.today

CVE Published

Apr 27, 2026 - 00:00 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipulation of the argument NewPortMappingDescription results in buffer overflow. The attack needs to be approached within the local network. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.

Technical ContextAI

The vulnerability resides in miniupnpd, a lightweight UPnP (Universal Plug and Play) Internet Gateway Device daemon commonly embedded in consumer routers to enable automatic port forwarding. The flaw occurs in the AddPortMapping function within upnpsoap.c, where insufficient bounds checking on the NewPortMappingDescription parameter allows attackers to overflow a stack-based buffer (CWE-120). UPnP services typically listen on the local network interface (commonly port 1900/UDP for SSDP discovery and ephemeral TCP ports for SOAP control), making them accessible to adjacent network attackers. The D-Link DIR-825 (CPE: cpe:2.3:a:d-link:dir-825:*:*:*:*:*:*:*:*) runs this vulnerable miniupnpd implementation in firmware versions through 3.00b32.

RemediationAI

No vendor-released patch exists or will be developed as D-Link has ended support for the DIR-825 product line. Organizations must implement hardware replacement or network segmentation controls. Primary recommendation: Replace DIR-825 routers with currently supported models that receive active security updates. If immediate replacement is infeasible, implement these compensating controls with noted trade-offs: (1) Disable UPnP functionality entirely via router admin interface (breaks applications relying on automatic port forwarding such as gaming consoles, VoIP phones, and some IoT devices); (2) Isolate DIR-825 devices on a dedicated VLAN with strict firewall rules limiting lateral movement (requires managed switch infrastructure and reduces network performance for segmented devices); (3) Implement 802.1X network access control or WPA3-Enterprise authentication to prevent unauthorized LAN access (increases administrative overhead and may not be supported by legacy clients). All compensating controls only reduce attack surface but do not eliminate the vulnerability. Full details: https://vuldb.com/vuln/359644 and https://tzh00203.notion.site/D-Link-DIR-825-miniupnpd-AddPortMapping-Stack-Overflow-337b5c52018a8028988ecc9daded409e.