Cyber Posture

CVE-2025-13304

HighPublic PoC

Published: 17 November 2025

Published
17 November 2025
Modified
08 December 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0059 69.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely.…

more

The exploit has been released to the public and may be exploited.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents buffer overflow by requiring validation of the manipulated 'host' argument in the /boafrm/formPingDiagnosticRun endpoint.

prevent

Mandates timely remediation of the known buffer overflow flaw through firmware updates for affected D-Link router models.

prevent

Implements memory protections such as address space layout randomization and non-executable stacks to mitigate exploitation of the buffer overflow even with invalid inputs.

Security SummaryAI

CVE-2025-13304 is a buffer overflow vulnerability (CWE-119, CWE-120) discovered in D-Link routers, specifically models DWR-M920, DWR-M921, DWR-M960, DWR-M961, and DIR-825M running firmware versions 1.01.07 or 1.1.47. The flaw affects unknown code in the /boafrm/formPingDiagnosticRun file and is triggered by manipulating the 'host' argument.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low complexity by an attacker possessing low privileges, without requiring user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially resulting in remote code execution or system crashes.

Advisories and additional details are available via VulDB entries at https://vuldb.com/?ctiid.332644, https://vuldb.com/?id.332644, https://vuldb.com/?submit.691808, and https://vuldb.com/?submit.691810, along with a GitHub issue at https://github.com/LX-LX88/cve/issues/11.

The exploit has been publicly released and may already be exploited in the wild, as noted in the vulnerability disclosure published on 2025-11-17.

Details

CWE(s)

Affected Products

dlink
dir-825m firmware
1.01.07, 1.1.47
dlink
dwr-m920 firmware
1.01.07, 1.1.47
dlink
dwr-m921 firmware
1.01.07, 1.1.47
dlink
dwr-m961 firmware
1.01.07, 1.1.47
dlink
dwr-m960 firmware
1.01.07, 1.1.47

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote buffer overflow in the web management interface (/boafrm/formPingDiagnosticRun) enables exploitation of a public-facing application for denial of service or potential arbitrary code execution on the router.

References