CVE-2025-10666

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DIR-825	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10

References

https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.mdExploit, Third Party Advisory
https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.324787Permissions Required, VDB Entry
https://vuldb.com/?id.324787Third Party Advisory, VDB Entry
https://vuldb.com/?submit.652047Third Party Advisory, VDB Entry
https://www.dlink.com/Product
https://www.exploit-db.com/exploits/52469
https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.mdExploit, Third Party Advisory
https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#pocExploit, Third Party Advisory

Timeline

Published: Sep 18, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-106679.8A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file CVE-2025-106689.8A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/co CVE-2025-106696.3A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Han CVE-2025-10677.3There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privilege CVE-2025-106709.8A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing o CVE-2025-106713.7A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-m CVE-2025-106727.8A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/Bat CVE-2025-106739.8A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the CVE-2025-106744.3A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attribut CVE-2025-106754.3A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/q CVE-2025-106764.3A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Execu CVE-2025-106789.3NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL