CVE-2025-13304

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DWR-M920	1.01.07; 1.1.47
D-Link	DWR-M921	1.01.07; 1.1.47
D-Link	DWR-M960	1.01.07; 1.1.47
D-Link	DWR-M961	1.01.07; 1.1.47
D-Link	DIR-825M	1.01.07; 1.1.47

References

https://github.com/LX-LX88/cve/issues/11Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.332644Permissions Required, VDB Entry
https://vuldb.com/?id.332644Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691808Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691810Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691812Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691817Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691821Third Party Advisory, VDB Entry
https://www.dlink.com/Product
https://github.com/LX-LX88/cve/issues/11Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 17, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-133059.8A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown proces CVE-2025-133068.8A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the CVE-2025-133077.2The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be CVE-2025-133085.4The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all version CVE-2025-133094.3The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to aut CVE-2025-13317.8IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the CVE-2025-133114.4The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting in all versions up to CVE-2025-133125.3The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capability check on the 'ntz CVE-2025-133139.8The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6.CVE-2025-133145.3The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modi CVE-2025-133159.8Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API aut CVE-2025-133168.1Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowl