CVE-2025-0492
Published: 15 January 2025
Summary
CVE-2025-0492 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Dlink Dir-823X Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of the null pointer dereference flaw in D-Link DIR-823X firmware to eliminate the root cause of remote DoS.
Implements denial-of-service protections to limit resource exhaustion and high availability disruption from unauthenticated remote exploitation of the vulnerability.
Requires vulnerability scanning to identify the presence of CVE-2025-0492 in router firmware, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null dereference in public router interface enables remote unauthenticated DoS (T1190 for exploitation of exposed service; T1498 for resulting network availability impact).
NVD Description
A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to…
more
the public and may be used.
Deeper analysisAI
CVE-2025-0492 is a critical vulnerability affecting D-Link DIR-823X routers on firmware versions 240126 and 240802. The issue resides in the function FUN_00412244, where manipulation triggers a null pointer dereference, mapped to CWE-404 and CWE-476. Published on 2025-01-15, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Unauthenticated attackers can exploit this remotely with low complexity and no user interaction required. Exploitation leads to a denial of service through high availability disruption, with no impact on confidentiality or integrity.
VulDB advisories detail the vulnerability, including submission records, while the D-Link website serves as a reference for vendor information. The exploit has been publicly disclosed and may be used.
Details
- CWE(s)