CVE-2025-25744
Published: 12 February 2025
Summary
CVE-2025-25744 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-853 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
D-Link DIR-853 A1 firmware version FW1.20B07 contains a stack-based buffer overflow in the SetDynamicDNSSettings module that is triggered by the Password parameter. The flaw is tracked as CVE-2025-25744, carries a CVSS 3.1 score of 9.8, and is classified under CWE-787 as an out-of-bounds write.
An unauthenticated attacker with network access can supply an oversized Password value to the affected module and achieve arbitrary code execution or a denial-of-service condition on the device. No user interaction or credentials are required.
The single public reference is a Notion page that documents the discovery but does not describe vendor patches or mitigation steps. The associated EPSS score has remained low, moving only from 0.0134 to a peak of 0.0158.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4133
Vulnerability details
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the unauthenticated SetDynamicDNSSettings web endpoint on the public-facing router directly enables T1190 (Exploit Public-Facing Application) for remote arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires bounds checking and validation of the Password parameter in the SetDynamicDNSSettings module to directly prevent the stack-based buffer overflow.
SI-16 implements memory safeguards like stack canaries and DEP to protect against exploitation of the stack-based buffer overflow for arbitrary code execution.
SI-2 mandates timely flaw remediation via firmware patching to eliminate the buffer overflow vulnerability in DIR-853 FW1.20B07.