CVE-2025-13305
Published: 17 November 2025
Summary
CVE-2025-13305 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-825M Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates the 'host' argument in /boafrm/formTracerouteDiagnosticRun to prevent buffer overflow from malformed input.
Requires timely firmware patching for affected D-Link models to remediate the specific buffer overflow vulnerability.
Implements memory protections like stack canaries and ASLR to mitigate exploitation of the buffer overflow even if input validation fails.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in the web-based traceroute diagnostic (/boafrm/formTracerouteDiagnosticRun) enables exploitation of a public-facing application (T1190) for potential arbitrary code execution and facilitates endpoint denial of service via application exploitation (T1499.004) by crashing the web server process.
NVD Description
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched…
more
remotely. The exploit has been made available to the public and could be exploited.
Deeper analysisAI
CVE-2025-13305 is a buffer overflow vulnerability (CWE-119, CWE-120) identified in D-Link routers, specifically models DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M running firmware version 1.01.07. The flaw affects the processing of the /boafrm/formTracerouteDiagnosticRun file, where manipulation of the "host" argument triggers the buffer overflow. Published on 2025-11-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability enables remote exploitation by attackers with low privileges over the network, requiring no user interaction and low attack complexity. Successful exploitation of the buffer overflow can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on the affected device.
References point to VulDB entries (ctiid.332645, id.332645, submit.691809, submit.691816) and a GitHub issue (LX-LX88/cve/issues/12) for further details, but no official vendor advisories or patches are specified in the available information.
An exploit for this vulnerability has been publicly disclosed, heightening the potential for real-world attacks against unpatched devices.
Details
- CWE(s)