Dir 825
Monthly
Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1 respectively. The flaw resides in the handler_update_system_time function within the libdeuteron_modules.so library of the NTP Service component, allowing authenticated attackers with high privileges to execute arbitrary operating system commands remotely. These products are end-of-life and no longer supported by D-Link, meaning no patches will be released.
Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and 4.5.1 respectively. The flaw resides in the handler_update_system_time function within the libdeuteron_modules.so library of the NTP Service component, allowing authenticated attackers with high privileges to execute arbitrary operating system commands remotely. These products are end-of-life and no longer supported by D-Link, meaning no patches will be released.