CVE-2025-13304CWE-119CWE-120

CVE-2025-13304

High · published November 18, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

⚡ A sneaky buffer overflow vulnerability lurks in D-Link routers, ready to be exploited remotely with just a little argument manipulation! 🔥 Think of it as a delivery service that miscalculates the weight of a package, causing it to overflow and disrupt the entire sorting process — the network gets bogged down, potentially leaving critical data exposed. An attacker can trigger this vulnerability and potentially execute arbitrary code remotely, leading to unauthorized access to your network. If exploited, this could compromise sensitive information and disrupt network services, making your devices vulnerable to a range of malicious activities.

Put simply

Think of it as a delivery service that miscalculates the weight of a package, causing it to overflow and disrupt the entire sorting process — the network gets bogged down, potentially leaving critical data exposed. This vulnerability is caused by a buffer overflow in the '/boafrm/formPingDiagnosticRun' code of several D-Link router models, allowing for remote code execution through argument manipulation.

What to do

An attacker can trigger this vulnerability and potentially execute arbitrary code remotely, leading to unauthorized access to your network. If exploited, this could compromise sensitive information and disrupt network services, making your devices vulnerable to a range of malicious activities. Immediately patch affected devices to versions 1.01.08 or 1.1.48 or higher. Additionally, consider implementing strict firewall rules and monitoring network traffic for any unusual activity. Don't leave your network unguarded! You've got this! Follow these steps to lock down your devices and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00876 · 58.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-11-18T04:15Z
Affected products (10)
ProductVersionsFixed in
dlink/dir-825m_firmwareall versions—
dlink/dir-825m_firmwareall versions—
dlink/dwr-m920_firmwareall versions—
dlink/dwr-m920_firmwareall versions—
dlink/dwr-m921_firmwareall versions—
dlink/dwr-m921_firmwareall versions—
dlink/dwr-m961_firmwareall versions—
dlink/dwr-m961_firmwareall versions—
dlink/dwr-m960_firmwareall versions—
dlink/dwr-m960_firmwareall versions—
References (10)
EPSS history
Timeline
  • 17 NOV 22:32Z
    D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow
    cvelistv5