Cyber Posture

CVE-2025-13305

HighPublic PoC

Published: 17 November 2025

Published
17 November 2025
Modified
08 December 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0059 69.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched…

more

remotely. The exploit has been made available to the public and could be exploited.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates the 'host' argument in /boafrm/formTracerouteDiagnosticRun to prevent buffer overflow from malformed input.

prevent

Requires timely firmware patching for affected D-Link models to remediate the specific buffer overflow vulnerability.

prevent

Implements memory protections like stack canaries and ASLR to mitigate exploitation of the buffer overflow even if input validation fails.

Security SummaryAI

CVE-2025-13305 is a buffer overflow vulnerability (CWE-119, CWE-120) identified in D-Link routers, specifically models DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M running firmware version 1.01.07. The flaw affects the processing of the /boafrm/formTracerouteDiagnosticRun file, where manipulation of the "host" argument triggers the buffer overflow. Published on 2025-11-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

The vulnerability enables remote exploitation by attackers with low privileges over the network, requiring no user interaction and low attack complexity. Successful exploitation of the buffer overflow can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on the affected device.

References point to VulDB entries (ctiid.332645, id.332645, submit.691809, submit.691816) and a GitHub issue (LX-LX88/cve/issues/12) for further details, but no official vendor advisories or patches are specified in the available information.

An exploit for this vulnerability has been publicly disclosed, heightening the potential for real-world attacks against unpatched devices.

Details

CWE(s)

Affected Products

dlink
dir-825m firmware
1.01.07
dlink
dwr-m920 firmware
1.01.07
dlink
dwr-m921 firmware
1.01.07
dlink
dwr-m961 firmware
1.01.07
dlink
dwr-m960 firmware
1.01.07

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Unauthenticated remote buffer overflow in the web-based traceroute diagnostic (/boafrm/formTracerouteDiagnosticRun) enables exploitation of a public-facing application (T1190) for potential arbitrary code execution and facilitates endpoint denial of service via application exploitation (T1499.004) by crashing the web server process.

References