Cyber Posture

CVE-2025-8949

HighPublic PoC

Published: 14 August 2025

Published
14 August 2025
Modified
18 August 2025
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0060 69.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8949 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-825 Firmware. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack buffer overflow in router web CGI (ping_response.cgi) directly enables remote code execution against a public-facing network device application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the argument ping_ipaddr leads to stack-based buffer overflow. The attack can be launched…

more

remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Deeper analysisAI

CVE-2025-8949 is a stack-based buffer overflow vulnerability affecting the D-Link DIR-825 router running firmware version 2.10. The flaw resides in the get_ping_app_stat function of the ping_response.cgi file within the httpd component, triggered by manipulation of the ping_ipaddr argument. Published on 2025-08-14, it is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation by an attacker possessing high privileges (PR:H) on the target device. By sending a specially crafted request to ping_response.cgi, the attacker can overflow the stack, potentially achieving high impacts on confidentiality, integrity, and availability, including arbitrary code execution or denial of service.

This issue only affects products no longer supported by the maintainer, with no patches available. An exploit has been publicly disclosed, as detailed in advisories from VulDB (ctiid.319915, id.319915, submit.627640) and a GitHub issue (i-Corner/cve#16); the D-Link website provides general product information but no specific mitigation guidance.

Details

CWE(s)

Affected Products

dlink
dir-825 firmware
2.10

CVEs Like This One

CVE-2025-7206Same product: Dlink Dir-825
CVE-2025-10034Same product: Dlink Dir-825
CVE-2025-10666Same product: Dlink Dir-825
CVE-2026-7851Same vendor: Dlink
CVE-2026-3978Same vendor: Dlink
CVE-2025-7911Same vendor: Dlink
CVE-2025-7194Same vendor: Dlink
CVE-2025-7909Same vendor: Dlink
CVE-2026-2927Same vendor: Dlink
CVE-2025-13188Same vendor: Dlink

References