CVE-2025-13305

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DWR-M920	1.01.07
D-Link	DWR-M921	1.01.07
D-Link	DWR-M960	1.01.07
D-Link	DIR-822K	1.01.07
D-Link	DIR-825M	1.01.07

References

https://github.com/LX-LX88/cve/issues/12Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.332645Permissions Required, VDB Entry
https://vuldb.com/?id.332645Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691809Third Party Advisory, VDB Entry
https://vuldb.com/?submit.691816Third Party Advisory, VDB Entry
https://vuldb.com/?submit.693784Third Party Advisory, VDB Entry
https://vuldb.com/?submit.693806Third Party Advisory, VDB Entry
https://vuldb.com/?submit.695424Third Party Advisory, VDB Entry
https://www.dlink.com/Product
https://github.com/LX-LX88/cve/issues/12Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 17, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-133068.8A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the CVE-2025-133077.2The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be CVE-2025-133085.4The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all version CVE-2025-133094.3The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to aut CVE-2025-13317.8IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the CVE-2025-133114.4The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting in all versions up to CVE-2025-133125.3The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capability check on the 'ntz CVE-2025-133139.8The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6.CVE-2025-133145.3The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modi CVE-2025-133159.8Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API aut CVE-2025-133168.1Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowl CVE-2025-133175.3The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. T