Cyber Posture

CVE-2025-13305

HighPublic PoC

Published: 17 November 2025

Published
17 November 2025
Modified
08 December 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0059 69.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13305 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-825M Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates the 'host' argument in /boafrm/formTracerouteDiagnosticRun to prevent buffer overflow from malformed input.

prevent

Requires timely firmware patching for affected D-Link models to remediate the specific buffer overflow vulnerability.

prevent

Implements memory protections like stack canaries and ASLR to mitigate exploitation of the buffer overflow even if input validation fails.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Unauthenticated remote buffer overflow in the web-based traceroute diagnostic (/boafrm/formTracerouteDiagnosticRun) enables exploitation of a public-facing application (T1190) for potential arbitrary code execution and facilitates endpoint denial of service via application exploitation (T1499.004) by crashing the web server process.

NVD Description

A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched…

more

remotely. The exploit has been made available to the public and could be exploited.

Deeper analysisAI

CVE-2025-13305 is a buffer overflow vulnerability (CWE-119, CWE-120) identified in D-Link routers, specifically models DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M running firmware version 1.01.07. The flaw affects the processing of the /boafrm/formTracerouteDiagnosticRun file, where manipulation of the "host" argument triggers the buffer overflow. Published on 2025-11-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

The vulnerability enables remote exploitation by attackers with low privileges over the network, requiring no user interaction and low attack complexity. Successful exploitation of the buffer overflow can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on the affected device.

References point to VulDB entries (ctiid.332645, id.332645, submit.691809, submit.691816) and a GitHub issue (LX-LX88/cve/issues/12) for further details, but no official vendor advisories or patches are specified in the available information.

An exploit for this vulnerability has been publicly disclosed, heightening the potential for real-world attacks against unpatched devices.

Details

CWE(s)

Affected Products

dlink
dir-825m firmware
1.01.07
dlink
dwr-m920 firmware
1.01.07
dlink
dwr-m921 firmware
1.01.07
dlink
dwr-m961 firmware
1.01.07
dlink
dwr-m960 firmware
1.01.07

CVEs Like This One

CVE-2025-13304Same product: Dlink Dir-825M
CVE-2025-13548Same product: Dlink Dwr-M920
CVE-2025-15189Same product: Dlink Dwr-M920
CVE-2025-15193Same product: Dlink Dwr-M920
CVE-2025-13553Same product: Dlink Dwr-M920
CVE-2025-13550Same product: Dlink Dwr-M920
CVE-2025-13551Same product: Dlink Dwr-M920
CVE-2025-13552Same product: Dlink Dwr-M920
CVE-2025-45059Same vendor: Dlink
CVE-2025-11338Same vendor: Dlink

References