CVE-2025-2620
Published: 22 March 2025
Summary
CVE-2025-2620 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dap-1620 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires organizations to identify and manage unsupported system components like the end-of-life D-Link DAP-1620 to prevent exploitation of unpatched stack-based buffer overflows.
Mandates timely flaw remediation processes that necessitate isolating or retiring unpatchable EOL devices affected by this remote buffer overflow vulnerability.
Implements boundary protections to restrict remote network access to the vulnerable unauthenticated authentication handler, blocking exploitation attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack-based buffer overflow in the web authentication handler (/storage mod_graph_auth_uri_handler) enables exploitation of a public-facing application for initial access or remote code execution (T1190, T1210) and denial-of-service via device crash (T1499.004).
NVD Description
A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2025-2620 is a critical stack-based buffer overflow vulnerability (CVSS 3.1 score of 9.8) affecting the D-Link DAP-1620 wireless access point in version 1.03. The flaw resides in the mod_graph_auth_uri_handler function within the /storage file of the Authentication Handler component, linked to CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). Published on March 22, 2025, it allows remote manipulation without authentication.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, user interaction, or special conditions (AV:N/AC:L/PR:N/UI:N/S:U). Successful exploitation grants high-impact confidentiality, integrity, and availability effects (C:H/I:H/A:H), potentially enabling arbitrary code execution, data theft, or device takeover on affected devices.
Advisories from VulDB indicate no patches are available, as the D-Link DAP-1620 is no longer supported by the manufacturer; mitigation requires isolating or retiring vulnerable devices. The exploit has been publicly disclosed and may be actively used, per references including VulDB entries and a detailed Notion write-up.
Details
- CWE(s)