CVE-2025-1103
Published: 07 February 2025
Summary
CVE-2025-1103 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Dlink Dir-823X Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the macList argument in HTTP POST requests to the set_wifi_blacklists function, preventing malformed inputs from causing null pointer dereference.
Ensures null pointer errors from invalid macList manipulation are handled gracefully without resulting in device crashes or denial of service.
Provides timely remediation of the specific null pointer dereference flaw through firmware patching for affected D-Link DIR-823X routers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null pointer dereference in HTTP handler directly enables remote DoS via application/system exploitation (T1499.004).
NVD Description
A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference.…
more
It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1103 is a problematic vulnerability in D-Link DIR-823X routers running firmware versions 240126 and 240802. It resides in the set_wifi_blacklists function within the file /goform/set_wifi_blacklists of the HTTP POST Request Handler component. The flaw is triggered by manipulating the macList argument, resulting in a null pointer dereference (CWE-404, CWE-476).
A remote attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. The CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a high availability impact through device crash or denial of service, with no effects on confidentiality or integrity.
Advisories reference a detailed Notion page on the vulnerability, multiple VULDB entries including submission details, and the D-Link website. The exploit has been publicly disclosed and may be used by attackers.
Details
- CWE(s)