CVE-2025-65288CWE-120

CVE-2025-65288

Medium · published December 9, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long hostnames from LAN hosts without proper length validation. The affected code performs unchecked copies/concatenations into fixed-size buffers. A crafted long hostname can overflow the buffer, cause a crash (DoS) and potentially enabling remote code execution.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-09T22:15Z
Affected products (1)
ProductVersionsFixed in
mercurycom/mr816_firmwareall versions—
References (1)
https://damiri.fr/en/cve/CVE-2025-65288 · [email protected]
EPSS history
Timeline
  • 09 DEC 00:00Z
    A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long hostnames from LAN…
    cvelistv5