CVE-2025-13305
Published: 17 November 2025
Description
A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched…
more
remotely. The exploit has been made available to the public and could be exploited.
Mitigating Controls (NIST 800-53 r5)AI
Validates the 'host' argument in /boafrm/formTracerouteDiagnosticRun to prevent buffer overflow from malformed input.
Requires timely firmware patching for affected D-Link models to remediate the specific buffer overflow vulnerability.
Implements memory protections like stack canaries and ASLR to mitigate exploitation of the buffer overflow even if input validation fails.
Security SummaryAI
CVE-2025-13305 is a buffer overflow vulnerability (CWE-119, CWE-120) identified in D-Link routers, specifically models DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M running firmware version 1.01.07. The flaw affects the processing of the /boafrm/formTracerouteDiagnosticRun file, where manipulation of the "host" argument triggers the buffer overflow. Published on 2025-11-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability enables remote exploitation by attackers with low privileges over the network, requiring no user interaction and low attack complexity. Successful exploitation of the buffer overflow can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on the affected device.
References point to VulDB entries (ctiid.332645, id.332645, submit.691809, submit.691816) and a GitHub issue (LX-LX88/cve/issues/12) for further details, but no official vendor advisories or patches are specified in the available information.
An exploit for this vulnerability has been publicly disclosed, heightening the potential for real-world attacks against unpatched devices.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in the web-based traceroute diagnostic (/boafrm/formTracerouteDiagnosticRun) enables exploitation of a public-facing application (T1190) for potential arbitrary code execution and facilitates endpoint denial of service via application exploitation (T1499.004) by crashing the web server process.