Introduction
Remote attackers can take full control of affected D-Link routers, which lets them intercept network traffic and potentially compromise every connected device. The buffer overflow sits in the traceroute diagnostic function and is trivial to exploit, and public proof-of-concept code is already available. That makes unpatched routers a prime target for opportunistic attacks.
D-Link is a major networking hardware manufacturer, and millions of its routers are deployed in homes and small businesses worldwide. Its firmware has a history of security issues, especially buffer overflows and web interface vulnerabilities.
Technical information
CVE-2025-13305 is a stack-based buffer overflow in the /boafrm/formTracerouteDiagnosticRun endpoint of several D-Link routers running firmware version 1.01.07. The cause is improper bounds checking on the host parameter. When a remote attacker sends an HTTP POST request with an excessively long or specially crafted host value, the firmware copies that input into a fixed-size stack buffer without checking its length. The input then overwrites adjacent memory regions, including control data such as return addresses.
Depending on the payload, this classic overflow can crash the router (denial of service) or let the attacker execute arbitrary code with the privileges of the web server process. The endpoint is reachable remotely and requires no authentication, so exploitation is low-complexity and works from any network segment that can reach the router's management interface.
Public sources include no vulnerable code snippets, but public advisories and exploit repositories confirm the vulnerability.
Proof of concept
The proof-of-concept (PoC) exploit for CVE-2025-13305 targets D-Link models DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M running firmware version 1.01.07. It goes after the /boafrm/formTracerouteDiagnosticRun endpoint, where improper handling of the host parameter leads to the buffer overflow.
How the exploit works
The firmware processes the host parameter without adequate bounds checking. An HTTP request with an excessively long or specially crafted host value lets an attacker overwrite adjacent memory regions. The overflow can disrupt normal device operation and may lead to arbitrary code execution with the device's privileges.
Potential consequences
- Attackers could execute malicious code remotely and take control of the device (remote code execution).
- The device may crash or become unresponsive, which disrupts network services (denial of service, or DoS).
- An attacker who controls the router could intercept, modify, or reroute network traffic and compromise the security of connected devices.
Mitigation recommendations
- Check for D-Link firmware updates that address this vulnerability, and apply them promptly.
- Restrict access to the router's management interfaces to trusted networks or specific IP addresses.
- Monitor the network for unusual activity that may indicate exploitation attempts.
A public exploit already exists, so owners of the affected D-Link models should take immediate action to secure their devices.
PoC source: https://www.cvetodo.com/cve/CVE-2025-13305
Affected systems and versions
- D-Link DWR-M920 firmware 1.01.07
- D-Link DWR-M921 firmware 1.01.07
- D-Link DWR-M960 firmware 1.01.07
- D-Link DIR-822K firmware 1.01.07
- D-Link DIR-825M firmware 1.01.07
Only these models and firmware versions are confirmed vulnerable. The flaw is in the traceroute diagnostic function exposed at /boafrm/formTracerouteDiagnosticRun.
Vendor security history
D-Link's router products have a long history of buffer overflow and remote code execution vulnerabilities. Notable earlier issues include:
- CVE-2020-29557: Buffer overflow in DIR-825 R1 (CVSS 9.8), actively exploited in the wild
- Multiple 2024 advisories for buffer overflows and command injection in DIR-X5460, DIR-X4860, and COVR-X1870
- End-of-life policies for many models, which leave them unsupported and unpatched
D-Link's response to security issues has been inconsistent. Some vulnerabilities have stayed unpatched for extended periods, especially on older or end-of-life devices.
References
- NVD entry for CVE-2025-13305
- Official CVE entry
- PoC and discussion
- VulDB advisory
- VulDB entry
- VulDB submission 691809
- VulDB submission 691816
- VulDB submission 693784
- VulDB submission 693806
- VulDB submission 695424
- D-Link official site
- D-Link security advisory SAP10341
- D-Link security advisory SAP10412
- CVETodo PoC and summary
