Cyber Posture

CVE-2025-2621

CriticalPublic PoC

Published: 22 March 2025

Published
22 March 2025
Modified
26 March 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0036 58.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-2621 is a critical stack-based buffer overflow vulnerability in the check_dws_cookie function within the /storage file of D-Link DAP-1620 version 1.03. It is triggered by manipulation of the uid argument and is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). The issue carries a CVSS v3.1 base score of 9.8, reflecting its high severity due to network accessibility with low complexity and no required privileges or user interaction.

The vulnerability can be exploited remotely by unauthenticated attackers with no privileges (AV:N/AC:L/PR:N/UI:N), potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Successful exploitation allows arbitrary code execution via the buffer overflow, enabling full system compromise on affected devices.

Advisories from sources like VulDB indicate that the vulnerability affects only D-Link DAP-1620 products no longer supported by the manufacturer, with no patches available. The D-Link website provides general product information but no specific mitigation for this issue. Security practitioners should isolate or decommission affected devices, as referenced in VulDB entries and a detailed Notion disclosure.

The exploit has been publicly disclosed and may be actively used, increasing risks for unpatched, end-of-life deployments.

Details

CWE(s)
CWE-119CWE-121CWE-787

Affected Products

dlink
dap-1620 firmware
1.03

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Remote unauthenticated stack-based buffer overflow in the D-Link DAP-1620 web interface (/storage/check_dws_cookie via uid parameter) enables exploitation of a public-facing application and remote services, facilitating remote code execution.

References