CVE-2025-25745
Published: 14 February 2025
Summary
CVE-2025-25745 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-853 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-25745 is a stack-based buffer overflow vulnerability (CWE-121) affecting the D-Link DIR-853 router running firmware version A1 FW1.20B07. The flaw resides in the SetQuickVPNSettings module, where insufficient bounds checking on the Password parameter allows an overflow condition during processing of user-supplied input. Published on 2025-02-14, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity by tricking a user into interacting with a malicious input, such as submitting a specially crafted Password value through the affected module. Successful exploitation could result in high-impact consequences, including arbitrary code execution, data compromise, modification of system integrity, or denial of service, granting the attacker substantial control over the targeted device.
Mitigation details are available in the referenced advisory at https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a664480ea82a7f8321d967187. Security practitioners should consult vendor guidance for patches or workarounds specific to the DIR-853 A1 FW1.20B07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4134
Vulnerability details
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web interface (SetQuickVPNSettings) enables remote exploitation of a public-facing application for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses insufficient bounds checking on the Password parameter by requiring validation of user-supplied inputs to prevent stack buffer overflows in the SetQuickVPNSettings module.
Implements memory protections like stack canaries, address space layout randomization, and data execution prevention to block arbitrary code execution from stack-based buffer overflows.
Mandates timely patching of the specific flaw in D-Link DIR-853 FW1.20B07 to remediate the buffer overflow vulnerability.