CVE-2025-0492
Published: 15 January 2025
Summary
CVE-2025-0492 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Dlink Dir-823X Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
A null pointer dereference vulnerability, tracked as CVE-2025-0492 and assigned CWE-404 and CWE-476, affects the FUN_00412244 function in D-Link DIR-823X devices running firmware versions 240126 and 240802. The flaw is rated critical with a CVSS 4.0 score of 8.7 and can be triggered remotely by manipulating specific inputs to the affected function.
Remote unauthenticated attackers can exploit the issue over the network to induce a denial-of-service condition, resulting in high impact to availability while leaving confidentiality and integrity unaffected. Public disclosure of an exploit means the attack vector is already known and potentially usable by threat actors.
The referenced advisories and vulnerability databases, including entries on VulDB and a detailed Notion report, point to D-Link’s site for vendor information, though no specific patch or mitigation steps are detailed in the available references. The EPSS score has remained low, with a current value of 0.0086 and a peak of 0.0170.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1715
Vulnerability details
A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to…
more
the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null dereference in public router interface enables remote unauthenticated DoS (T1190 for exploitation of exposed service; T1498 for resulting network availability impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of the null pointer dereference flaw in D-Link DIR-823X firmware to eliminate the root cause of remote DoS.
Implements denial-of-service protections to limit resource exhaustion and high availability disruption from unauthenticated remote exploitation of the vulnerability.
Requires vulnerability scanning to identify the presence of CVE-2025-0492 in router firmware, enabling proactive remediation.