Cyber Posture

CVE-2025-2620

CriticalPublic PoC

Published: 22 March 2025

Published
22 March 2025
Modified
26 March 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.2640 96.3th percentile
Risk Priority 35 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-2620 is a critical stack-based buffer overflow vulnerability (CVSS 3.1 score of 9.8) affecting the D-Link DAP-1620 wireless access point in version 1.03. The flaw resides in the mod_graph_auth_uri_handler function within the /storage file of the Authentication Handler component, linked to CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). Published on March 22, 2025, it allows remote manipulation without authentication.

Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, user interaction, or special conditions (AV:N/AC:L/PR:N/UI:N/S:U). Successful exploitation grants high-impact confidentiality, integrity, and availability effects (C:H/I:H/A:H), potentially enabling arbitrary code execution, data theft, or device takeover on affected devices.

Advisories from VulDB indicate no patches are available, as the D-Link DAP-1620 is no longer supported by the manufacturer; mitigation requires isolating or retiring vulnerable devices. The exploit has been publicly disclosed and may be actively used, per references including VulDB entries and a detailed Notion write-up.

Details

CWE(s)
CWE-119CWE-121CWE-787

Affected Products

dlink
dap-1620 firmware
1.03

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote stack-based buffer overflow in the web authentication handler (/storage mod_graph_auth_uri_handler) enables exploitation of a public-facing application for initial access or remote code execution (T1190, T1210) and denial-of-service via device crash (T1499.004).

References